{ "Event": { "published": true, "date": "2026-07-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-28", "timestamp": 1785283382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "7df11b49-e9cb-4064-85ac-e23632e2b987", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daee2089-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221100, "uuid": "01fa76aa-804d-4f7e-913d-1e2004d5a9cf", "comment": "Malware payload", "value": "c93b565d9c6b897e127a17ffcaa8d50e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221100, "uuid": "c046d2be-454d-4c9e-b668-ad2aa5b13ba8", "comment": "Malware payload", "value": "009803420ed70ac96ff0783784ddd70bfa1b05f430fc753278b9266e7848a32a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221100, "uuid": "3aba1cff-5bb1-44c2-851d-f3a263b33e9b", "comment": "Malware payload", "value": "67768afe9c7413efd88c741df27c445ce2f66d9b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221100, "uuid": "7046c9c0-906e-46ac-8ec4-a0c4edd1ab1b", "comment": "Malware payload", "value": "720ef17378559f74c2bfa7be08c8d42ad103cf97a0610cbdccb7e9d65058dd9a3b824cb094c6e529f2ed4bec0067aaee", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221100, "uuid": "a4f47303-785a-4ff2-9efd-03f6de4d755c", "value": "T16572DF96CB8A17A2C53AF1782DCC9DA782E4B06ABE6531F6C541A15D5F010902FE3B28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221100, "uuid": "0d4a49c9-95f1-4fe7-9f66-798d5dab3024", "value": "384:0OlPiKg1T/tQs6BwINOqEs/fmh4OZcNxNFyee9DhTVcvyaFfY:0OtgZ/KNOqD/+WOExNFyN9DhxMzpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221100, "uuid": "61284894-5230-4919-8672-9c4a320f3f6f", "value": 16854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221100, "uuid": "b98ff629-5faa-41f8-9bcd-a56b480ef925", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221100, "uuid": "046fad0a-0f76-47a1-9a4f-3ee6e35502a3", "value": "images_20260727_174906.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0354029-8ac8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785272971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272971, "uuid": "5d566467-0900-4eb6-9e69-5a34abb972ab", "comment": "Malware payload (Mirai)", "value": "39126c3e430e2e8d42034b125201971e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272971, "uuid": "32108220-6896-4f4c-b521-44d3aac67afe", "comment": "Malware payload (Mirai)", "value": "00bd53b28e21671f2bbbe4aff588c4ce7a41f357bb69c920f3b8227cd27d24cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272971, "uuid": "a8046541-af3d-4ebe-bfa6-62269be9f58a", "comment": "Malware payload (Mirai)", "value": "2a2441a37c815d46536beec79e5f36bb3ee6d457", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272971, "uuid": "b2ed88fd-1907-4529-abae-99f5675a02e5", "comment": "Malware payload (Mirai)", "value": "8d2bc6e8a6d8f5d0fa26f444a4e36559c84a691c2880ef5f13d8f6db65e5558641ca66370374c2515d46d5d89f9bc2b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785272971, "uuid": "c235bc0a-ab76-4258-a34c-7aa8d0a5330e", "value": "T105632A6BB9919F15C5C0167AFE1D534D33132BBCE3DEB213EE042B642B8B56B0E2A445", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785272971, "uuid": "6dabf1d9-4e81-482b-b5a2-b94daf7325d5", "value": "1536:xtnrrlWcNjqc7kBWvHpIcqAAqxtoDAWMiT8alJ1xEOilN:vrTjtnIfAXxtU18alJ1nW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785272971, "uuid": "e87004b1-ac6e-41ca-9e6b-730a27bb7cde", "value": 67972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785272971, "uuid": "eb176115-7065-4ba0-96f8-0f2c4d54011c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785272971, "uuid": "0b62aa98-12be-48ee-bdf6-357cddb42448", "value": "5FF", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c581500c-8a91-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1785249411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249411, "uuid": "06ed9a99-0929-483b-900f-d3f8e85cd76e", "comment": "Malware payload (VIPKeylogger)", "value": "89e73d08beffeab30899db2998d36d45", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249411, "uuid": "9d553d15-3004-46e6-b074-6975ed97f107", "comment": "Malware payload (VIPKeylogger)", "value": "00f3f063d8d0a6a00c44a900ab2464b2d2d78d4b9ad0cfc61902807ce5fd9e15", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249411, "uuid": "6b6ad3b4-ebe3-4529-bb65-6e4cedd24aa4", "comment": "Malware payload (VIPKeylogger)", "value": "cb950157063464c09b488f06cbd6941d7f61c943", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249411, "uuid": "f0a9576c-2ecb-4388-af20-c831599abe51", "comment": "Malware payload (VIPKeylogger)", "value": "18249618c77a7f1f6df45b6095721b15c31c8d7d3f05a51da0d51a88642f8938d4a42a9c46115df9d68fe02fa168f7c5", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249411, "uuid": "481eebdc-02b5-4723-8abb-86b06739f5d2", "value": "T13A95335D802E2025758B89DC5FBD37AB8662C7DEC49D7211E39B94F1803117E28CF6EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249411, "uuid": "89396465-67c9-4fff-bcd4-48a79d0da2c7", "value": "49152:HD9xiTgO1mrbjQ4W5538MIJf6aHYjLapQJe5PPfM2UTxbyIh85WwWhaiVg+O5r:j9oT11efQ4s53NIEGYjLze5PPfbIxbXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249411, "uuid": "6f62e43a-d13a-4a4a-ae4d-f81000b5e73f", "value": 1932390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249411, "uuid": "1ff10244-b610-4872-a266-2fb4a2163a18", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249411, "uuid": "f05805fd-d5b8-4189-b90d-c1df7a6f28c1", "value": "Revised_Price_Offer.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94acb2e-8a7a-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1785239566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239566, "uuid": "b797787d-d5fb-4e37-8dfc-2638f9bf0baa", "comment": "Malware payload (LummaStealer)", "value": "41d9eba31f341c2c2a4cfd6af4a94023", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239566, "uuid": "870e465e-3d83-45f8-b34f-4697bdcd43ed", "comment": "Malware payload (LummaStealer)", "value": "00f41782b7ffda43f48a632433f8d70d2363600af03b02182009d72d825ec650", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239566, "uuid": "f65c468c-195d-48e7-a17b-8b7d35fc97a0", "comment": "Malware payload (LummaStealer)", "value": "10c82fb76c490fc5970d71b603f99c4be7975d6f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239566, "uuid": "febde6b0-6d5e-4ae7-8c8c-ebb273d1bc73", "comment": "Malware payload (LummaStealer)", "value": "01cebb3cc693ef76edd6598aa7b4105df81bb2b04633c69622b5e8f7d5a539c19bccda489b062ca6cb477cbb7e0fcef4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239566, "uuid": "a8c040cf-fb22-41a4-ba3c-23cea5d96443", "value": "T105D53A12FDC745F6E402163158A763AF27396D091F39DB93EE447A79EE372E20832609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239566, "uuid": "eb12e9ba-7222-4315-bc45-df4a08e54313", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239566, "uuid": "373ccc51-a7e7-4f0d-b64d-180705f0e6c4", "value": "49152:zykgwh4Y4/fCIPX9fH9N/MrbQp89ms4c7:uChH4/v5M4phk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785239566, "uuid": "9f06c110-d86b-4963-b392-13ad06c4ad48", "value": 2910072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785239566, "uuid": "f93566ef-f2c4-4415-8e1f-c78286e04adb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239566, "uuid": "d60933c6-6745-4b79-ac83-adcb41be8250", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2931f9e5-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220802, "uuid": "c2912a9f-21e5-407d-a5b2-6207cdaba806", "comment": "Malware payload", "value": "ca3836f38b1b29bde56e3bd59357c6c1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220802, "uuid": "88116154-f3db-415a-884a-b30cbbf9451d", "comment": "Malware payload", "value": "0105632311a04172848c32c8a0efff989c2f508b43fad0b1042f549422792ee7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220802, "uuid": "856712db-12dd-477e-b262-1ca1ce6dd66c", "comment": "Malware payload", "value": "caa7f7626ca53f40b51767a243d6063265bb67d2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220802, "uuid": "23fc1b3e-ef20-4396-819a-3ac031b44337", "comment": "Malware payload", "value": "c6cef1f3e0233a76720b53ea0f0b0a4e0adf0a61f8f912467469f06fb8f2833e2d8780a0a9d0c3663a0922a3d5b961cf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220802, "uuid": "f22837bd-7c1e-4923-a236-75171326ca3a", "value": "T1E642C0588395E73E1D72B6334D90F06995DC8968497D71C7A29B321F3921FB63AE6C00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220802, "uuid": "ea3929a3-98ee-488e-a43b-53d0661da8e7", "value": "384:Sutj/sqIxxu7rsHL5mz9GdPGz/OI5Cv8h:Su9/UasrQCa5Cvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220802, "uuid": "df6602df-f628-42f4-9328-635cd25fc922", "value": 12917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220802, "uuid": "08c3e35a-d883-452a-9e28-26a285f2b67b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220802, "uuid": "619a9eac-6247-4afe-b614-999422f05575", "value": "images_20260727_095431.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78be0a23-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249712, "uuid": "26d7b577-9e5a-48ee-9fc1-54045b9cea42", "comment": "Malware payload (Mirai)", "value": "be46a232ca9dc2aa05297ffba8e22a7a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249712, "uuid": "9289dd01-88d1-4640-9e2f-d60faf84fd86", "comment": "Malware payload (Mirai)", "value": "0108093a705b25d73f0f90de1c558f8964422c8baf3330b80e19455f0616e8a5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249712, "uuid": "cc789097-0aea-4f38-8576-226fab188b56", "comment": "Malware payload (Mirai)", "value": "b089dcc25756efd84849683a2c7c3cba6cec698b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249712, "uuid": "52b942ac-4be4-445f-96e3-65e65b1a8bc6", "comment": "Malware payload (Mirai)", "value": "9b20567b5b596ee50d2bb580d449bd04e54f68b39f9a4c9875779b05a804e8b3a6273b0f90b671f1dc66281c5d198a09", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249712, "uuid": "68eae1a1-3b95-4222-b90e-4e76e4f93d55", "value": "T1E053F19FA50E3242DAD508BCB4ED37F486413092F24B6F49C9826CC6D29E64778DCDB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249712, "uuid": "7935c6da-cb54-4555-a468-556ca61a7d3c", "value": "1536:vN63bsbg19+146R3RHeAXiYSk8u0xhRM0gw09d31vI:I3BZ6tRcYh0za1w0/31Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249712, "uuid": "713555d7-de18-4426-b3aa-7085e71b9b56", "value": 60776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249712, "uuid": "426bd17e-dc79-49c6-a288-c6fff7979d12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249712, "uuid": "8b3f53fa-c4e8-40ad-9863-359b928aa0f6", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1cb67a-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220964, "uuid": "22d65d6d-fdb7-4877-919f-d79d1f6b4644", "comment": "Malware payload", "value": "d4ff93bcc45bc8804453296c09cb614a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220964, "uuid": "ecb002cb-c73f-4ed1-b874-1fee37465c9e", "comment": "Malware payload", "value": "017d18bad4c7b867199cf438240624797792d2dec1bd4e2d7031241e856aaa33", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220964, "uuid": "b6a736c7-0e36-490a-9d0d-4c4c92b598b6", "comment": "Malware payload", "value": "1465294e32e9fbeaa61f4ab5c76b868a9a4dc80c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220964, "uuid": "cd01adc0-7436-4e53-b7e0-bf76bb545605", "comment": "Malware payload", "value": "c25a56c921b48bffbf4ebd473c39b59cdcd9e9ac9c077c1f73136ecf315e3b8c03903596e40b27bf5b4e8e78cb9ee433", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220964, "uuid": "735f79f5-5fe4-48fb-a192-a96d96ab7b84", "value": "T14332C0455D1D482DE03317E8F884AE0D9832F0B95BBF3E9E7C8718C620627B70A96746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220964, "uuid": "a67b16ae-6e67-47ad-acba-04af4889c4cf", "value": "192:OyvRtJdg1ybjR8zpv4bVTB+hHIefhsyRu3Xif8ZqweNj0PLyr:1JUS18yDo1hPRu0ID0jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220964, "uuid": "9032818f-dc2e-4db4-ab6c-22f8b7f8819a", "value": 10985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220964, "uuid": "7be02db7-b336-470e-8e41-93a8b73d8fdb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220964, "uuid": "aedf948e-1bd0-490f-8f52-ee0c6c5ced67", "value": "images_20260727_125055.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac40a644-8a8a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785246362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246362, "uuid": "4d015ab5-69db-4468-8e2a-d91b01aa9c0c", "comment": "Malware payload", "value": "5e1372e7ebd1af23d561404f5292a3cc", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246362, "uuid": "4fe3f0ea-500d-4147-b7ed-f6e73b229328", "comment": "Malware payload", "value": "022590d85dbc435ab9087ae0d741e8675aa46adec1a01b314e1689f7297c3025", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246362, "uuid": "8c1e1fda-8be0-401f-959e-09d70636358f", "comment": "Malware payload", "value": "bf00aeba99ab8afa468ff05d03cb7969334b7325", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246362, "uuid": "36e97568-6775-4787-b136-2a9219e852d2", "comment": "Malware payload", "value": "0626059542eb8694a79ee6ec0c0bc2f9166f2492cef92eac4c63c3147073b57c36fd76bc79960e05fe929a934ad052cd", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246362, "uuid": "dcda4f19-9d90-4316-809f-1a81aed68710", "value": "T15E06C091B3C469E9C452DE399714E232C2B2B9234B76D0CB5E96C70A0FB6D524F3EB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246362, "uuid": "fef799e7-beb3-4955-9e9f-fb605ec1f9cb", "value": "b1c022f21e313c400a3bd74350a836c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246362, "uuid": "ae784c03-b4d5-4974-a486-1f0b62b58dc6", "value": "98304:x4FImRLNQts597c+wizw7kNh44dLCgTiilznbt3fva62TrFkL+dycuVbM939blcf:x4FPQts59wddUL9OEznRvtArFkL+Qb6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785246362, "uuid": "9e1807d1-3b33-43b4-bfa7-2cde021f93bb", "value": 3879936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785246362, "uuid": "499fce41-4cd5-4aa6-8785-f3f86e76ce30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246362, "uuid": "deb80eab-3126-4208-9099-1819ed3df563", "value": "atom_2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6920e4bb-8a97-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785251833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251833, "uuid": "9892ae79-ca8a-4d20-ab51-f61ff2739f46", "comment": "Malware payload (Phorpiex)", "value": "d20a462ee82fc009d69338c62a759272", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251833, "uuid": "29f0e01d-bfac-4ddb-9a0d-af64395dc93b", "comment": "Malware payload (Phorpiex)", "value": "02479b50896ebe3d90514056603edb2ba16394bfe2249e1eca795667f8ca1508", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251833, "uuid": "e7320563-0a10-4024-bacc-c2c1de035536", "comment": "Malware payload (Phorpiex)", "value": "23a2658314925b0415ca5d0d1ace75dcd46afed9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251833, "uuid": "5c00aedb-f3a9-41ec-b94a-bd84f77f4f0b", "comment": "Malware payload (Phorpiex)", "value": "92e68867020ceba164fd9fb11bcfc530d76794d5b86c4559f2711f388710173777a105933baa10bedd1bbcbfb229e1b4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251833, "uuid": "6619b426-9c64-4d1a-b591-445da2b81bea", "value": "T1C443B69167F9151AF6F38E783C7465568C7BBE726D61E08E8280204F0875B95CE78B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251833, "uuid": "f704d3b1-71a7-433c-aa9a-15d5e6c905c1", "value": "83fa772670ac674cd68ff73f3ef04802", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251833, "uuid": "d7cd4b15-6772-40fd-ac79-880cee26314e", "value": "768:NpM+/0vaXDiTLlGCI0App3vWSph6koM3R+qsq:LCEiTLXA3/fp4koUR+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785251833, "uuid": "0efe765b-e7b5-4067-96c1-4ad9501679e7", "value": 55296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785251833, "uuid": "1a55ca8e-5636-469f-9a5f-250a4e080c8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251833, "uuid": "2c12f027-23e8-47c7-b0c0-268c4460b77f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f2ea78-8a96-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785251348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251348, "uuid": "c54966f0-5014-4bde-9ce5-a487ccd48d1b", "comment": "Malware payload (Mirai)", "value": "1896fdcd7fb94263dce24ed7c2c4bcbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251348, "uuid": "a821c683-5530-4162-9c5d-d8f1107a043a", "comment": "Malware payload (Mirai)", "value": "0275d7b76fb12f336927a089281b6b19edfdd5d6540f46b2b29e057a648549ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251348, "uuid": "db6f725c-9e1a-4855-abc1-c5750326f4cd", "comment": "Malware payload (Mirai)", "value": "0e5924c73f123635a4f6c722af43574998d5fc00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251348, "uuid": "684b0048-2a1a-4450-83d9-179dda50351b", "comment": "Malware payload (Mirai)", "value": "719dea8522dfb4399996d16a9f8182730fc1431961f0293c21c3420ca649f35b84c9e2f7378e6e675802dc56eb3e4a72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251348, "uuid": "7715b541-eb5a-44ff-b665-6cfc149d219e", "value": "T12E133B3286785A1BC1C0E33F11A39372E1FA2F8461A4575F3E690E5EBE59340577A3A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251348, "uuid": "0ab20d2b-fb0c-4159-810d-86994179a850", "value": "768:TU3n2GTuXCxQOH4+sWARvJxQDTvboFnIIFT86UgBZEPb7+0H:S3dH4xbQsFD18h8C1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785251348, "uuid": "e597cda6-2a2b-477e-a13f-18466fb28aea", "value": 43872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785251348, "uuid": "d9f354e7-7fbb-4786-9a9f-85872781caff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251348, "uuid": "2c528f48-04c2-4eea-92b1-a6c4a11b08ce", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3dd4bd-8aa4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785257636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785257636, "uuid": "393b3a2e-0625-4df2-bd9f-63f1143cd7e1", "comment": "Malware payload", "value": "b5465746a177d1b162767b506934282e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785257636, "uuid": "9bfe4ffe-da03-4fb8-b2b8-89a677a5e897", "comment": "Malware payload", "value": "02e58824c588545a5c05396577f4f12977e7b9189fc96058d444bffa4d263e0c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785257636, "uuid": "2c9dd58b-335a-4cea-9cae-a323ca9b1787", "comment": "Malware payload", "value": "357071522dba67d5c5b5c4477137b67d4aa5e40b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785257636, "uuid": "5830fe00-4f6a-4386-a90b-dc612ebe59c4", "comment": "Malware payload", "value": "d55923ee9b93938b42ff2b0e2fa21896dc8eb3a23337576e4e2a82a5dca194cd6619e1b35cc96b54063b7d75b5bcc422", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785257636, "uuid": "f62e43fa-b768-4aba-b0ef-8ec946b46b19", "value": "T170F423509F066DCCD9BA2715C1277F8192478E820CAE68CF508B79BFF8337C6B952466", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785257636, "uuid": "0efb9714-3772-4eee-b48e-c402a73b6948", "value": "12288:dbMmjPOtuMlu5/a8B+zxp63iSZzXUHoweJBqBtlmDugeyagA6LlGHntGwO0W2Kn:JMmj2tUvD3xZ6eGBnmDfeLpnVO+Kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785257636, "uuid": "8266cd4e-7c31-441b-92f7-43a90f5a365c", "value": 743378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785257636, "uuid": "db00f641-7655-4897-aa81-731df16ba527", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785257636, "uuid": "5b6872f8-7ba3-41f3-ac84-a98dbb6c1623", "value": "FACTURA ELECTR\u00d3NICA DISPONIBLE PARA PROCESO CONTABLE CON NUESTRA ENTIDAD BANCARIA_infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4e4a8e-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220859, "uuid": "ad2bc5c2-9e61-48af-abb6-8c69618d47f6", "comment": "Malware payload", "value": "1462459de15bb2c694a3ea068069f19b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220859, "uuid": "14bf2cc6-f82a-46d5-a19e-027c3a621e3d", "comment": "Malware payload", "value": "02fef7e59ef3d871c5a89d38c62be7078559b0303329d6f6bc9b8e6713fd6a29", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220859, "uuid": "cc2a50fc-5230-49c5-833a-238ab0c625c9", "comment": "Malware payload", "value": "59c5a82648473d3f29af128d71f2699f97e1c376", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220859, "uuid": "7442ba44-223f-4d97-902d-3a781ee6368b", "comment": "Malware payload", "value": "efb22cf637d34b1b2048e71f116c2127a60f453c97d387fc19a8815f379bb72bd4f34ae90890de179993a1bf0c01e482", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220859, "uuid": "789d271d-7637-424a-a05d-234eae042b6f", "value": "T1C0D18D4068F95C68C7237F33F1D75E6F95982AC61D0E3C074B3AAD90871215A611EB7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220859, "uuid": "b2b9b8db-0bb9-4ec2-b4b4-99a1492d3c5d", "value": "192:jzbR8Wb6XJy2CQ+/QISp69hXrVJ60CV010B:nt8Wb6XJAQ+/Y407010B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220859, "uuid": "7355fb83-0f9d-4cf2-ad8c-9884c0bce9d9", "value": 6551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220859, "uuid": "8ec29c00-6962-40dc-909b-d3dddb68976a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220859, "uuid": "a54764cc-bc56-4489-b71d-902136420166", "value": "images_20260727_161811.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467cc3e3-8ac6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785271961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271961, "uuid": "3d140488-fa96-4d0e-a315-eb9c7e6d7e61", "comment": "Malware payload", "value": "bbb84eeb69eaba4ccb0abba05e62bc00", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271961, "uuid": "6474796f-8d81-403b-9c5e-91391432e6de", "comment": "Malware payload", "value": "03dfc82a8c47cd17e2c443d5121b5a19c3355afd69ed08dee1210250f628282f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271961, "uuid": "2a020af1-0454-4312-ae12-a98c6d6f93a2", "comment": "Malware payload", "value": "c12985bed4baa647ba28a4143426cd78e92b5eeb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271961, "uuid": "174d3728-6d7f-47af-8d28-676ba2939e18", "comment": "Malware payload", "value": "dbc525db505bc1352229bad5c86751b35aeb29734697fe68b6b9227068c8f89cf5486b4454f55e832cd6e4e66b6d037a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271961, "uuid": "2543d157-045e-4c1a-903c-74291c7fc37d", "value": "T1C4B66B47FC9118FAC0AAA33189A35A527775BC182B3627DB2E60B7782F727D08D35714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271961, "uuid": "c69632b0-a8e1-4313-9692-774bfed72229", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271961, "uuid": "52327413-8edb-44d3-83b4-8073c42f4895", "value": "49152:LooAYY44HBu/mcpb65YyQpYJhWNqqZUk2ZZ9sNj9Mkgoogc8:Li6H3ywxN+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785271961, "uuid": "73bb6970-77c3-48a5-b17f-494e295921b7", "value": 10861384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785271961, "uuid": "47cb8970-ed28-4ebb-8b70-5d9a63a6dacb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271961, "uuid": "3f6db957-ca4f-4c18-9680-64a71483c8b1", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1139de-8a21-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785201080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201080, "uuid": "3fc77662-1b23-4b3b-bd8f-ab927ac619b8", "comment": "Malware payload (Mirai)", "value": "dd6bf477d998dc93f51145ed6dffe8f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201080, "uuid": "d0caad13-c42a-42c6-8135-fca0842ad55f", "comment": "Malware payload (Mirai)", "value": "043bdf3f2ec52afa39922ea6a7cb3e4830361de4242a448e9e0b9561148a2ad0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201080, "uuid": "53f3d43c-eec4-457c-8660-ae40e0e7f3b3", "comment": "Malware payload (Mirai)", "value": "30bb6baaf5d33906658fa2b5b3ee5a62b87a978a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201080, "uuid": "0b2488bd-d2cb-4280-b022-5562ff8b413c", "comment": "Malware payload (Mirai)", "value": "1ce1b29b4a2c2d55b3d89ad4fecaf60069aec1b695ccd18a72727ed62a4359c46d79031b9a4d4330f2a2ba38b582a8b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201080, "uuid": "5d29642e-369d-4c8d-a8b6-43b2ab1d0493", "value": "T1D293C60E2E318FADF779C23587F74A20976873C626D1C689D26CE5025F7024DA41FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201080, "uuid": "029827de-e4a2-4e8e-9b58-40c2cbd6b0bc", "value": "1536:hSEVa53YB4fGBkVBP9+h/Fxlbr/ttSXgZDEDG1VeDCEBYQHkLQs6exuNhI+Urn5E:hi53XGBkVBP9+h/Fxlbr/ttSXgZDEzBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785201080, "uuid": "cb559a9c-9dbd-45d8-9da3-2dd9e544ee65", "value": 97140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785201080, "uuid": "e158ab37-a540-47bc-9150-3cfe29825a74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201080, "uuid": "88316e9f-5b31-4aef-8ade-c36c12825a60", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17502e72-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233227, "uuid": "4f584a32-0053-4ec0-9cc1-cf301343a002", "comment": "Malware payload", "value": "1a35bc533a74297729f4e822068c916e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233227, "uuid": "324e22a9-28b4-4a47-9016-c968796aa08c", "comment": "Malware payload", "value": "043cdd7e96742564b0b063e14f389ff3e00485e2f57ee94b7f42997d19365519", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233227, "uuid": "b38154fc-28a5-417b-bd9b-279320dab918", "comment": "Malware payload", "value": "8ea51b9024f9101d8067fc2e41675a0d827be864", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233227, "uuid": "15cf5b3b-2845-4ac7-be00-3fe01b631484", "comment": "Malware payload", "value": "9239b4ec50e4c4565a57c537d017333a6bce7d9fbc93c24ec70cebd6f8853a63ed4eb0d866d79cc3fde78ef5c6307599", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233227, "uuid": "68919bbb-ee34-4240-96b5-57591f65e872", "value": "T1B5F1BF90563D49B2E1F1BFF6B0D392D9E1A0B2512F003C9E7A9D0B2C3109B9610E381E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233227, "uuid": "b06705f5-c945-480f-b79c-e29abace5808", "value": "192:jnsmUTrbXQIwDuUPwXFmqEL3w9+X1L+iC1xgNIgRel2:D7aXV8um1k9m+cCgow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233227, "uuid": "958a5def-5ae8-4844-a1d8-3e5447da8561", "value": 7646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233227, "uuid": "089c92dc-c00a-479e-a834-c99401b9a501", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233227, "uuid": "305e924e-d1fe-4881-9cef-cdf9807fcbca", "value": "images_20260728_091529.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c076a0-8ad8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785279635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785279635, "uuid": "40e26a42-7dfb-4e54-bdfe-0b799bc820a1", "comment": "Malware payload", "value": "e1c9c724efe90addefa31262586c8662", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785279635, "uuid": "cb938e2c-5a67-4c9c-a10f-653cd4c350dd", "comment": "Malware payload", "value": "045ada423b20079a8d1175a47077c1933b06a7e7963eab4dff8d4bb11702c2a4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785279635, "uuid": "be8ce6dd-7dd7-4b0f-8241-90e3b49a3493", "comment": "Malware payload", "value": "d39a7f528748d1b7b1517bc4dfc7d797a9188d38", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785279635, "uuid": "b2d28ea2-09cd-4d92-aebb-eb0c180fd324", "comment": "Malware payload", "value": "b21be53910c270c5d75de49a8f4428ed2b2875c32015ba5598eb67d082593940628dffded8c62f5990dbe2faedc1d297", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785279635, "uuid": "59805da7-9a67-4bcb-b281-158dbe71eb18", "value": "T191823B0FB9424316E1E110B49665967BD9B9AC7637C414EBFBD44AEE0A686C1FC3210F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785279635, "uuid": "95f516ff-5142-484f-848f-6bc91a387700", "value": "dfba23467fe5a12366e7fde987218cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785279635, "uuid": "644c3844-d3b6-4089-bf41-ae1d8cbda81b", "value": "384:AHZbmcmhzcEUaUu94gXFP+av8U9c+h4P:P9UaF9Qa0U10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785279635, "uuid": "14eebc15-d8a1-4add-bfb1-47b80f3d8571", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785279635, "uuid": "032c7429-49ce-4acd-8120-4762c146bfde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785279635, "uuid": "eb4de576-cdd4-4fd0-a9ab-c4e543a4fdee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1225dbb-8a91-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785249377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249377, "uuid": "314db332-adc3-4a4f-93bc-1461abc1f7ce", "comment": "Malware payload (AgentTesla)", "value": "319e1e3803fe1ce76c35d48a9d673565", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249377, "uuid": "fb0410e8-056a-46e9-b0bd-5548a1d69be1", "comment": "Malware payload (AgentTesla)", "value": "04812630dcb086af236a69d05fbd85d4e6359c118048cacf2a1964ee330c2204", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249377, "uuid": "5dabecd0-88f6-4705-a791-a004605ec70d", "comment": "Malware payload (AgentTesla)", "value": "636527a99be24d74edc39f0143b862501227e96e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249377, "uuid": "aab8ad1c-b5af-4ecc-a2e6-7e481d845394", "comment": "Malware payload (AgentTesla)", "value": "48bb8fa0a406d1bddb22254d1160fa441fb488f7da095925ec4f2e56c13c22a365a198c1ec487529d3444c9db6f4ec38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249377, "uuid": "30e63633-e1a6-4463-9bf3-625c24d90f3c", "value": "T15AA511F51B574B01A13126FBFFE701B0BD79F1784867469FA4C46EA3628E50A092CE72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249377, "uuid": "a73bf346-117d-468c-8913-799116ff7861", "value": "768:eXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX4:BJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249377, "uuid": "36d96546-ca29-4555-a6a3-e2644d6e28fa", "value": 2169232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249377, "uuid": "3d855252-74b5-4b56-aa5f-671691b0eb19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249377, "uuid": "4112472a-6003-47ff-9633-6c97dbdc3b8d", "value": "RFQ230092.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cfc16be-8a1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785199951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785199951, "uuid": "8d2f6341-52c2-48ac-b1d1-b3e96ffddd67", "comment": "Malware payload (Efimer)", "value": "ba1a44c6bfd17c461d2ebf0f033bae12", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785199951, "uuid": "949e16d4-2117-4c50-a28e-36081904b55c", "comment": "Malware payload (Efimer)", "value": "04ef9757c950005f926458dee36517a6c879d39e5798a378bdd6aa7a45d0d23a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785199951, "uuid": "c4db4cd9-605e-4cd6-a02a-6b89615efc99", "comment": "Malware payload (Efimer)", "value": "22edef81c1fe81db499b3084b3c128b96a70c5a1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785199951, "uuid": "7028b74d-e1df-4c82-a84b-fe3c4c163cba", "comment": "Malware payload (Efimer)", "value": "74c385f96ab18439faa656cacf1905f381e7e8c51d46410ec4b92035642b917ff30b69aea5d3341559de5e24aa036ca2", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785199951, "uuid": "d7857b53-ae7e-4af2-8969-1782732c0937", "value": "T123E6330827F122DEF6B3503DFED20516E5A9703A2B72C9EB9B5453716F471E18E3A242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785199951, "uuid": "0d1f1d83-e29a-4a08-ba78-74b6a62f9f9b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785199951, "uuid": "c370670d-029e-49f5-9e69-be14503e1867", "value": "393216:B+cI5DSiUihxiXB9tXMCHWUjX+cuI3/PGTAI:BNI5glX/tXMb8XzH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785199951, "uuid": "0bfc7821-f64b-4444-9e03-eeff5b783c50", "value": 14278005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785199951, "uuid": "fbbb2f21-85ee-47c3-8273-45e736f2547e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785199951, "uuid": "a862c8ae-5466-4a25-a388-1f0763522440", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52912627-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220871, "uuid": "7fea298e-5c11-4c4f-b80e-4074e8d3cf9c", "comment": "Malware payload", "value": "87e36970bf21f81c96552d68d1643677", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220871, "uuid": "d0aca37a-ac8a-497e-a461-c8086719c06d", "comment": "Malware payload", "value": "0581de3be86be85b9d09e2f5a3144e33abce85409c1c491e1b697b8d2d50bca8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220871, "uuid": "020198ee-b64c-4e89-a583-d03d9a306dd0", "comment": "Malware payload", "value": "128bba954de45065f6885a085d8c727d1266015d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220871, "uuid": "e236d1a8-394e-4782-a1c9-0bd142e9f57b", "comment": "Malware payload", "value": "1a87b24577060a4bddc695212eb826e76045dadb20cfc000bed895a1a669fcefb93c70ba5377b1fd38f93777e121f101", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220871, "uuid": "6c205f92-16d3-48b0-a7fd-d91d950cf398", "value": "T19972CFBB830F5CF8D4E6BDF412241CB894CAFDA03DD206EE5C55A179189882EE730326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220871, "uuid": "4b9fad82-ed14-4168-910b-acc6b707f3d1", "value": "384:+85tBpKtzlAv52RZjofZDczA2k56/vuCRT:+87BpC/oZczXkQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220871, "uuid": "f25f6733-5e08-4b65-91ff-f2916b041178", "value": 16012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220871, "uuid": "da92228f-26fd-44e2-9754-5797ee8cfb30", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220871, "uuid": "ab094437-ff57-4929-a33d-208f915197b1", "value": "images_20260727_142830.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f70ca66-8ac4-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1785271117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271117, "uuid": "d3b6c4ac-4098-425f-bc0e-0e3857b238a7", "comment": "Malware payload (RustyStealer)", "value": "dc23b8b8afcffbf1798d09ebf443af85", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271117, "uuid": "bb2b0af1-272d-4d24-8664-bcc5163e4b96", "comment": "Malware payload (RustyStealer)", "value": "0605015c8428fb4efc98e0abd8af027c7a01f2e87471dbc7e4389a3c6e5844c4", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271117, "uuid": "2a6b1c22-a39d-49f3-94e3-828b83c511e8", "comment": "Malware payload (RustyStealer)", "value": "a7793c7102527152dc5972d13adb21969fe49e7a", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271117, "uuid": "86a19a36-6c89-43d0-b1f1-097d80498272", "comment": "Malware payload (RustyStealer)", "value": "b1ea09866ec4e878b6a59e4af6519be746cf40d4cda11d9f67f7cfa3ac68687f2dccea3b769157ec0a919355cbcb3a8b", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271117, "uuid": "2dd2f0b0-af9b-4e99-9aef-8d30066d99f8", "value": "T1E925BE53B291A27DD15BC0B4835AC9B6B536B0C90631BDBF21E4D7343E9AE920F1CB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271117, "uuid": "8234ffd3-af29-465a-8ef0-6a25f82f8e49", "value": "b949039b6ebe4372b35d3494c33e4a51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271117, "uuid": "ec4afaa5-774f-47fd-a2cb-70701c69a00e", "value": "12288:/4yljr5bCTpu7BIopiE1uLwpQk4ls9dJW76G3L6m442wOyITRMc08SdhccB:DASBnsE1e2QZuyT3L6mt5ONTRb08Yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785271117, "uuid": "a7658bb3-1d98-48ac-82df-0eb09914c6e6", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785271117, "uuid": "27bb7a85-4251-4781-90f1-9fe575e2912e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271117, "uuid": "2a2d94ce-237a-49ae-8619-72dde8152c68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0bcf9d-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785245691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245691, "uuid": "08496da2-7151-47d0-a4b8-cac4bc480652", "comment": "Malware payload (PureLogsStealer)", "value": "21fb6930c2679a056a8cfd79f93f53cd", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245691, "uuid": "38fec041-d953-4f00-93a6-dc7d6252aaec", "comment": "Malware payload (PureLogsStealer)", "value": "070181f442b486e6bc3192434f99c19bff30441fdc069a2274987d742178c2ec", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245691, "uuid": "7e91e70b-e3e1-44b2-b7ac-ce3b4ae597d8", "comment": "Malware payload (PureLogsStealer)", "value": "d2adac82d0821c8590dd95599abd5bd1e43ff1d8", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245691, "uuid": "0780f591-3702-4ec9-8d79-48ae41b4600f", "comment": "Malware payload (PureLogsStealer)", "value": "093552eb1a7f6bb02b370ed30060f7e05f2a03e9ab1a58ed768dc135ed39ff842179de5cfa2e126e3ef3bad35784cd5a", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245691, "uuid": "9aeff61b-dfab-42a5-abd5-d112285862e4", "value": "T1B305BF6B77824F21C24A2372C1C7490187EA864376ABFB0B718513D61E473EEDE4B697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245691, "uuid": "0958ac5f-4836-458c-af4e-b38e10063220", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245691, "uuid": "0c1bf4b4-f388-4fa9-b88b-8331370aceb6", "value": "12288:VOBkAAB9XyH8KM/0uQ3cxaIdChRLJtRtYLZHudMa0Y/k9fMgnsbhE:hXk8KMMuzojtRtydHY/k97si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245691, "uuid": "39dd5075-17db-4861-b72b-96cb993def3d", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245691, "uuid": "7af2c74a-c8da-4e70-9077-697ddbb08533", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245691, "uuid": "c328299f-b7a1-4aeb-bc85-062af1a85b93", "value": "070181f442b486e6bc3192434f99c19bff30441fdc069a2274987d742178c2ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2ece92-8a46-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785216938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216938, "uuid": "b633977a-2287-401c-aec2-e42f69c5875d", "comment": "Malware payload (ConnectWise)", "value": "691f35bf0e51a5c1445a284029c28e29", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216938, "uuid": "14d6e59d-be79-492b-b2d9-d42a6ccc07da", "comment": "Malware payload (ConnectWise)", "value": "072fb279608d062dd75764fedc60c55f672a9eb381fa243b53164c9be0a841c8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216938, "uuid": "e48cb398-bf85-4b93-befe-b1e4b2db2da0", "comment": "Malware payload (ConnectWise)", "value": "ddb04687c03c542b8f21f68be0fe0161c004a243", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216938, "uuid": "4f555ea4-24f2-42aa-8996-2bab08b1f3ac", "comment": "Malware payload (ConnectWise)", "value": "e046cfa1c40d964f55a249c29d1191d48916fd43bf60be51b3e690c165acd0450010907bbd43d86fef591a749744cd5d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216938, "uuid": "9824166e-1807-443f-9b69-23008584899a", "value": "T142646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216938, "uuid": "b09c46ea-7f92-4a3b-ac31-5493c59f7fac", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216938, "uuid": "503f0aa1-3b82-416c-a3e1-6cd8c2f4915e", "value": "6144:NmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9z:o1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785216938, "uuid": "5b78309c-1e6e-4fb0-8397-f10def3843e2", "value": 312584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785216938, "uuid": "cc1dcbbd-673c-40c8-a5e1-716021383517", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216938, "uuid": "3ca5d39d-e63e-4d69-871c-e61371eaab28", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87979683-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220960, "uuid": "e0ad1614-e0fe-4dd1-b3b7-3833488b43b7", "comment": "Malware payload", "value": "66a8d6d19660f538da46a4883ca42f1d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220960, "uuid": "e36da416-749a-4451-b7c3-6d2a257cf16f", "comment": "Malware payload", "value": "0747cf8288079954e8ebc601ae6416c7932bf8e71b140288e95d0ba19b1a0602", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220960, "uuid": "199f92da-d19c-43ad-acf5-9c9bd569df7a", "comment": "Malware payload", "value": "d6dd9bd1ce99ef284d734bea8ad4fd700e8fb718", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220960, "uuid": "df4839c1-2198-488d-9a44-b6c45a487ad5", "comment": "Malware payload", "value": "ac021b77b4ac819bcddeea609c7078889af08e565692d4f0855e970cc698dd7dcd598602009553cc9bc0fb7183481bd2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220960, "uuid": "ca8d0777-a781-4fd3-aee3-c8ed46fe0f6a", "value": "T11962D134FB8E53E5E953393CB849451C55E85C93EF886A29B9C62E0A04F78F60909E0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220960, "uuid": "86c9defb-ede5-4c32-9f00-9f3a9918fbc6", "value": "192:R6TYfQM6ocZfxxFN5JKtivywJ5zyO46Th6P2EGElPFQgbBn3a3kjhCtkh9eJiL4n:RLfCtHKtwFxkVhBVaU8C92iL4Hq0wud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220960, "uuid": "32a2d65e-0e39-4b15-8c94-d48dfe38c6f8", "value": 15510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220960, "uuid": "a1d4955f-e563-48e2-af4e-18f6dc168e58", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220960, "uuid": "576f95ef-b272-4a3a-a284-35ac1080fde0", "value": "images_20260727_143951.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6059ca89-8a2f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785207150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785207150, "uuid": "46df7b5a-66b9-44a9-9d5b-816044dc328b", "comment": "Malware payload (Efimer)", "value": "b2070d140b362a0ad381ae4c6dcf48a7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785207150, "uuid": "984c3d45-c429-4428-9c58-9fdf27852423", "comment": "Malware payload (Efimer)", "value": "07e01575db8e5a3b8a97aa7977a631e541f412548d16f15f8744969f1540d609", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785207150, "uuid": "cbbcda75-f49c-4302-93db-8c6316419d69", "comment": "Malware payload (Efimer)", "value": "34dc012e9f8a987b38fe2f775d37782d2c9d04e9", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785207150, "uuid": "07c95fcb-e590-4239-a37f-daf3d3fcc608", "comment": "Malware payload (Efimer)", "value": "3614486efbf770bc687005d5af2cb2455110b73bf6fd0053ddbffc935b39bd31afd680d9c36a93ee62d196656cce966d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785207150, "uuid": "2dcb726f-21b1-4eaf-8cd1-e08d08b8bca2", "value": "T178E63308A6D011ECE9B2003DADF36A96E51474A50F76C5EF9BB483916E172F19C3E31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785207150, "uuid": "718d6fc8-ccef-4c71-a444-3019b922db29", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785207150, "uuid": "9b8ff9a5-81c9-44da-a81b-6feb6c6fd6a1", "value": "393216:Jk6feU57UkCiUAIMkbElXMCHWUjXTcuI3/PGTAI:JB2C7udg3lXMb8XQH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785207150, "uuid": "4007f293-03f5-4a88-8c74-8814515b7ffd", "value": 14280086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785207150, "uuid": "ac1656bb-ee8a-4181-91c7-2d31033a00e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785207150, "uuid": "4de1669a-6896-419f-82f0-4f800f5075d6", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e55d39-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785224551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224551, "uuid": "703cc4d0-f240-4fe5-91b6-a44a653d5079", "comment": "Malware payload", "value": "59fadae9147b13160a550a76d653e244", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224551, "uuid": "c5444ef1-faec-42ef-a406-58370a468305", "comment": "Malware payload", "value": "084fe09f5ee53c42c0da99e6eda84afe9660390daf67a8c919436881549619d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224551, "uuid": "35897782-61ae-417b-b120-3d6d088b6d66", "comment": "Malware payload", "value": "53c3d23705804d472dfd1fd4b5d277e92a5566a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224551, "uuid": "3bdd32d5-921a-4149-8579-0d8b347e5ed4", "comment": "Malware payload", "value": "ae7ea61f28a5aef147e043cda0c40d00fe33be1b1bec3f84838a3debf547c6d147e1473c96d4026f2c1dcbc46ea920f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224551, "uuid": "6ef3a4d0-3722-49ab-94c8-e93846e99891", "value": "T153266B55FC1E7462D9C97A352F7652943239FC094F82C3272618BB7CAAF27588F23261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224551, "uuid": "0439b10d-b517-44cb-89ba-57886532c9de", "value": "24576:ObnPXtL/H0qMDWkGDYHt0RMTNNAz0czPt42178Gaw0wuLOOWdSjS+ckSctaQBC0P:ObnvtjGDSAt/wfzPt421puK8txBW5EF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224551, "uuid": "583e02e0-4cb0-44a1-8088-02d72aa86013", "value": 4456596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224551, "uuid": "09faa537-d036-49b3-b123-e7a56766dd37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224551, "uuid": "6dc503c5-ffc9-47c7-8243-8221a25b71c2", "value": "rcuop_0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bbc1f8-8a91-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785249384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249384, "uuid": "2e67af0e-9f6d-441a-8408-768ddff8e44d", "comment": "Malware payload (XWorm)", "value": "72ad0d3b9c263c0aa8dcc26990f794e4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249384, "uuid": "31894162-b138-4bcc-96a9-9adbb6790d31", "comment": "Malware payload (XWorm)", "value": "095bc1f68b458fac05aae349543df9de3961749561fdd48d8f1914bff0f5db9e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249384, "uuid": "3eac6e93-0002-4232-b23d-dd23d6791434", "comment": "Malware payload (XWorm)", "value": "8321ede87805bcfd70bfe651a41153a2c00e1c63", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249384, "uuid": "7426f49a-86ed-43a7-8433-c1c1d461fe7f", "comment": "Malware payload (XWorm)", "value": "d4b8b61783d0038612f8534c982a6f83d0f7481cf965b43d984553eafb8f203917db95dd218f07dc6393b5865b7f4a80", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249384, "uuid": "a94cc7cb-aba9-47da-8107-831fe172bbf8", "value": "T1D6853B56F7DE0FAD47316F146E33980AB83A60F0492F842EE51BB094ED4E6B95385DB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249384, "uuid": "c4b68788-cdab-4ee3-9570-0277437c5419", "value": "768:hxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxD:3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249384, "uuid": "24a856fe-23db-4818-9e5b-a9bb763eee45", "value": 1776995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249384, "uuid": "62c4fd87-80fe-4b41-939c-f2f0b88fa8eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249384, "uuid": "4fe3b933-6107-4d1d-9a45-2b8fc9f2c729", "value": "Slip-02.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5fa684e-8a8a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785246351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246351, "uuid": "8e71b7bd-cc05-4c92-bd10-ca8e5dca4c06", "comment": "Malware payload", "value": "189483a8b9dfa1637de045aad18c9137", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246351, "uuid": "8afe5c00-7053-4992-8100-10e3d0c45adb", "comment": "Malware payload", "value": "0a3b1d6ec59becdc48c2f5096a85bbf49334d3011370de5aaf926e1eb4e7b5f9", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246351, "uuid": "29c665b1-49b2-439f-950d-df2b2329fa25", "comment": "Malware payload", "value": "d15950fb4152b09e00d97320430b64372f2cae2b", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246351, "uuid": "c18308c5-dade-42a7-ab9a-06371156c0f2", "comment": "Malware payload", "value": "25c952d2a8f6b3d9897909f726c02c0cfd0a464be98ca092156c46d2546651145f7194699d589cdc6d63bfad3c2a8e37", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246351, "uuid": "8485a2db-ce71-4e18-8545-787945cc695b", "value": "T145D5CF25E3DA01A8E567DB78CB529332D6B178561731E58F0688D7162F33EE09B3B312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246351, "uuid": "34082716-c702-46f9-9df7-0aaa8e680981", "value": "bc3dc3de1f0cff256fd0a8f89b497b53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246351, "uuid": "7535d1db-868e-4b91-8da7-70ca5add81f4", "value": "49152:R1oHJQxmJ8x5r4FDqiHqgDnsPMFVM3WCaqujNa1qq4aSk:RCF3JnVFVVhxjjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785246351, "uuid": "b24d3ee7-bf9d-4084-b46c-f90dca8089b2", "value": 2836480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785246351, "uuid": "2320a2d6-3789-429b-8305-f9357c54ca5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246351, "uuid": "d8842e14-7798-45e0-a80f-552dd99b7ec7", "value": "atom_1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b0b3b3-8a67-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785231293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785231293, "uuid": "5d46562f-f7ac-4248-941b-71ba4db1c6e5", "comment": "Malware payload (RemcosRAT)", "value": "b3bb3ece03bef87c6161560d53cdbfe4", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785231293, "uuid": "68ef67a2-a0e8-4193-aaba-22d3dcf7aa34", "comment": "Malware payload (RemcosRAT)", "value": "0a4d1d785d7cf88797490eda1ea21e7bd7e46429d60fd3c93261ae125ed53305", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785231293, "uuid": "cdb5af77-702c-4b9f-aa66-58422afa1377", "comment": "Malware payload (RemcosRAT)", "value": "75d3914e0bc41a7574f4f350399460ad92521da5", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785231293, "uuid": "cae42e5f-5547-44dd-9711-e5eb3f1ef61f", "comment": "Malware payload (RemcosRAT)", "value": "a501035c13a40ed02472262ac8ca2d861f6223038518d43c9006fcc76537d1e5b549b418f0602b72aef6df1a17022699", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785231293, "uuid": "532c9c7a-d9c2-4870-916d-0a4575d0dc9c", "value": "T128441820DCD40B3A0E5707DDFF504A65C9FDC629862790ECEA9E171E50125ACEBBF268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785231293, "uuid": "9dda9a81-9533-47f6-b7f4-b626998aac86", "value": "6144:FupvvHhXiaceWnsXlNpXyJhDqqE1RB3VXYDTkE:iUaceWQnp04HLYEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785231293, "uuid": "6446b742-5041-4572-af56-076720a5e64c", "value": 275870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785231293, "uuid": "f4f0ecee-dd83-481a-9a54-e0de3280b5b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785231293, "uuid": "2e3bdc47-8c8c-4161-b7c3-a1302e2fd843", "value": "PO-P15126 P15826.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97a3452-8a7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785241740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785241740, "uuid": "5997d76e-608f-4849-9098-6c3bd2390dee", "comment": "Malware payload (AsyncRAT)", "value": "1f7c4122131ba1c798fe09827fe1ee9b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785241740, "uuid": "2e60ea59-1691-4d54-9c69-9b82ce6c65bf", "comment": "Malware payload (AsyncRAT)", "value": "0a50174b6ef5b50a5d26fd07855446697d6d8145d5162a8df3de50c6e54aaad9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785241740, "uuid": "0e1868a2-74bf-4f6d-82db-502964b4a195", "comment": "Malware payload (AsyncRAT)", "value": "702ce7777c83b63a0d20ffbf80b439394b712e64", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785241740, "uuid": "e608ede6-938d-49b8-9c5a-64c7ba41c3c6", "comment": "Malware payload (AsyncRAT)", "value": "9c8aa441e068d51d393cbc32e532ff00e212f6305bf04d6b5f44b942dfa1516959eed5e419ee74030c7aad6da53cb20a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785241740, "uuid": "82389d5d-351e-421a-800e-27112832b39e", "value": "T16E0512007699D612F47B2BF829B6E17053B5BC9EA930D25A8FDA7CDF78727108800767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785241740, "uuid": "a3c6e403-12d6-4dd3-9edf-9e558af472f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785241740, "uuid": "34a82396-88bd-4db4-8e7d-cd0e52871387", "value": "24576:oQc/vMZdusi9UWIIJBoGkF9yl2wpZEbeZ:YkDWh7kpwEbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785241740, "uuid": "5d897d3f-7274-4cdd-bba3-ab87fc209644", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785241740, "uuid": "c6175811-622d-46c2-8f3c-98cfb167e4f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785241740, "uuid": "3c3540dd-c75f-4666-b577-7517c117703e", "value": "Our Order no. 274419.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7402e516-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785211049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211049, "uuid": "d50ad3cb-d68f-4a35-9e4d-6e9a2b4a1179", "comment": "Malware payload (Mirai)", "value": "f24bf81f1bcdff36e61f8ee8af7ba6c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211049, "uuid": "d18852eb-82b5-4ff0-ac7e-1223477bf3c7", "comment": "Malware payload (Mirai)", "value": "0b4071d176141e739f3dce84c44f02e194f5be4cd12a3fb4945d84dd43600b25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211049, "uuid": "20ee0b35-40a2-4b43-b37b-f1a4b23b677a", "comment": "Malware payload (Mirai)", "value": "8f800b49bb81d9a81fcbde49815cdeabda9db701", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211049, "uuid": "ec4b9c31-b722-492d-ac4a-e63959ab4017", "comment": "Malware payload (Mirai)", "value": "ecf0d4e2410b87772e08534b27969fce9045a74b7aee5708f7f99f4bc7a57f52eefd28ec5401f669bfa45e752a3f5235", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211049, "uuid": "ec0fcdb9-06ab-4cb7-93b1-9b56ba08d352", "value": "T1F2F47D2AB2B3B1BCD01BC03047DBCAB25571F47522312E7B26C4DA353E6ADA1175EB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211049, "uuid": "d1f967bb-5b8b-4581-91ba-46dd86dd4cc9", "value": "12288:mfVjecCCZRJlDxcYBjsizNgNOtQhLdxHyWob14z0YfP8ayUm3HX:mFecCUJlDXBjHzNgQaDz0Yfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211049, "uuid": "c563c5a5-5b16-446d-ba28-c39c3af4a71f", "value": 755824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211049, "uuid": "96621f31-c737-4396-809d-f4ea5fcf5f37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211049, "uuid": "233fbf00-f8d3-4200-838a-fb5b098969fc", "value": "real_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6eb063-8ab5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785264752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264752, "uuid": "0bc03e12-ebb8-4850-9f64-3bd984e7e0cb", "comment": "Malware payload", "value": "1795dc309add7a85887fe95758ed3ae8", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264752, "uuid": "68f54faa-a2d3-4495-9f07-5eb67a37c1b7", "comment": "Malware payload", "value": "0bdbb0f2361160d4c5e71ed923fde9e0133ee6927c8a02a3f491cee1b83a1982", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264752, "uuid": "0309eedd-fb8e-4cd6-98fc-0992f29132c4", "comment": "Malware payload", "value": "3aa3b396a17eb6f470771407946bd2dbee22bba1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264752, "uuid": "8e98f7e5-6e50-4811-9327-69649b9d26e7", "comment": "Malware payload", "value": "aa2a369752ce167db751c7be26a01eb7e31e0f744a7de26b882116d4983448ab939b3c96256cba1a4ce5fd1fa52cce19", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264752, "uuid": "67fe3a7c-34a6-4639-8940-07485576d66a", "value": "T1AFE6338969D502EEFEF3513CD8E1A692E9B478B60BB0C49F17849B512E133E14D3D326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264752, "uuid": "1505500e-fb54-41e1-a0e2-85529b3f7a82", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264752, "uuid": "2de2edb4-2ce4-4e25-975e-1c2404acbd61", "value": "393216:X1WlQ7wzNJbAm+yHgFg1SEveXMCHWUjXzcuI3/PGTAI:XzcDbAm+fFgSZXMb8XwH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785264752, "uuid": "e6ad5e8f-0541-4002-8818-60efaa9d309b", "value": 14315177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785264752, "uuid": "0cf84802-4b02-4690-b85d-755d183af700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264752, "uuid": "12c39510-9d94-44cd-813c-0858e03c83ca", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a4e1f6-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221002, "uuid": "576df5c3-0457-4eee-84ca-c36e34523372", "comment": "Malware payload", "value": "2ed5f9f0097da19250706c52a7f52d2f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221002, "uuid": "a7d4f6e3-4d50-40e8-ac13-57a6c705497c", "comment": "Malware payload", "value": "0c04b4e230f7cf0822335ae5b51518908729b9d4cf3d5edad1ffb517cb69f275", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221002, "uuid": "0bb3e6fb-9bfa-4d83-995b-d4c8d2a15921", "comment": "Malware payload", "value": "42abb33e1f7fea1ecdbddb8bfa603a3f8fe2f056", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221002, "uuid": "cd120218-9f1e-4a0b-8322-5c6cb2c8a364", "comment": "Malware payload", "value": "797c469c93fd2a3b85a43bafd89f9709b2dd1e04bea058fbf0827d81512729651c60def58a3267af54739534552fc236", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221002, "uuid": "a21a527b-4060-4b23-830e-ea716ac299f7", "value": "T1E7E1AF23E608B945D336C5F225FA6B54853D612223046CF65D3D0AD2153B1AF0763AFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221002, "uuid": "59f45cb6-40ad-4748-b6e6-3eb7d72f5e5a", "value": "192:HG0+47tX5O2qKwZyyw27ShU2fTX2tEyol3y9:HZXX9q/wlZhHTvy43y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221002, "uuid": "c7b9e317-bb00-4e51-97e9-62ee06ac7d11", "value": 7153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221002, "uuid": "8c1752da-8276-4852-8ed5-878a3e1db0da", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221002, "uuid": "ce78fe60-92ff-4058-bc0b-e53b8004a6aa", "value": "images_20260728_035840.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b32f45d-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785211061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211061, "uuid": "7bf8f6dd-6516-4907-80b9-29d42ef474e8", "comment": "Malware payload (Mirai)", "value": "e92ff01e7ccbc373fe229d7636473f23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211061, "uuid": "fd9a1f59-17df-405a-98b7-153e63c34392", "comment": "Malware payload (Mirai)", "value": "0c378757c482de97435dbb36057d3149a7cdb9f84b936816de3ceb7598d5178d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211061, "uuid": "4da83571-1fde-4d37-9aed-0bb355a833a6", "comment": "Malware payload (Mirai)", "value": "0f0629af449ab689ed3b32946a6cae1f5c5ee25b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211061, "uuid": "24130600-fa9f-418e-91dc-2b1e6d1b4228", "comment": "Malware payload (Mirai)", "value": "58ba98837204c43d279814b2eb1e10bb2ecaa09fa95a8d95b2a72a64b57ccbc1c8ac43a3a34d8e474b21c45a13b6cffc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211061, "uuid": "17bfc1cb-a965-4d20-846c-c47a4b2e8898", "value": "T139D48D537731CF64E361D67005E387259AA121A60BE3A4C7A37CC6207A50B6C6D6FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211061, "uuid": "d5336087-69ec-4ce4-bb73-8652a7459038", "value": "12288:MnvBqoxx3eHG1J4ZLGdB4nCVgpMbmYWzMCm/ECic:MnZwQ4ZLGdBECEYzj/ECT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211061, "uuid": "9eaa5cbb-150c-4e8f-93f2-a4dc284d74ce", "value": 651188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211061, "uuid": "5b79b07f-40c4-4e77-a974-fe26fbccff82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211061, "uuid": "eb2fff49-5de7-4bc1-9eb4-f5255e2a4ab4", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21504992-8ac5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785271469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271469, "uuid": "e4cba86f-75fe-4303-ade0-d5f670990a2a", "comment": "Malware payload", "value": "41409ad703019aea6d370fcca8c0cb87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271469, "uuid": "5969ff58-9b7a-4e87-91cd-092aa4b9b4df", "comment": "Malware payload", "value": "0c77c688c8e96f308e67772abeb7de9bfed680d186301daf720338fc7780ea6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271469, "uuid": "e0ed28d1-ff9b-43c3-b218-f03d833d8e03", "comment": "Malware payload", "value": "0f72e46291b324cc7f2d06b5c8549a43e4f05b0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271469, "uuid": "181b80a0-bb54-408d-9f53-f740755ab3b0", "comment": "Malware payload", "value": "be095148b91e6ffd5d121bc5137d6c6889d9dd4c309bfc0ae7536ad5459ac04f8fcf8e48b22e97dc43653a50c1f0b67a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271469, "uuid": "0fda7f72-508b-4d96-8999-c643f2699b58", "value": "T1AA83185AFD819F15D5D526BAFF1E534A33536BBCE3EE7102DE102B24278A91B0F2A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271469, "uuid": "bf7fd25e-80f8-4d9a-9059-ee6b8fe69483", "value": "1536:fZntNY3Ls5zEXFGfBC41fvNWsWaRZPdVCJkGGI05wdllcie4vLrkE:vNY7uEVmvws5RRdVCJkGGRgM4v3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785271469, "uuid": "c75631ea-393f-45d9-8f08-4f9d4812c552", "value": 80936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785271469, "uuid": "2f44e29e-87c4-465d-a021-9d68c5e541a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271469, "uuid": "89b45741-cf22-43ac-aa81-99b027ed7da6", "value": "LFt3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893f6521-8a8a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785246303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246303, "uuid": "1df1a0c7-0a43-4bda-aabb-f77eecbd417f", "comment": "Malware payload", "value": "eb74075db25e1978b05e06302a15db53", "object_relation": "md5", "Tag": [ { "name": "Alberiox", "colour": "#2A275D", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246303, "uuid": "c62f7f34-924f-48e3-96a4-dd2ccbf12e61", "comment": "Malware payload", "value": "0c877a93b403a8b78c9bae76cd6f74a78f97dbad4f0b9e549ce0393eab18fb58", "object_relation": "sha256", "Tag": [ { "name": "Alberiox", "colour": "#2A275D", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246303, "uuid": "9696e207-37e2-4bd8-bd3a-9058f354c1bc", "comment": "Malware payload", "value": "67f0dbca0db11c4617d04bd901a55bafb88e8fec", "object_relation": "sha1", "Tag": [ { "name": "Alberiox", "colour": "#2A275D", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246303, "uuid": "5e9d0244-62a2-4cc5-a798-3a34302a0d51", "comment": "Malware payload", "value": "82f277cdb772308ad8188790ec4fc575c82b516aa93253dd722c11e79220e1487dc7cbff7b55e584c5e21f8f2dde32d3", "object_relation": "sha3-384", "Tag": [ { "name": "Alberiox", "colour": "#2A275D", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246303, "uuid": "da01a906-aea7-452f-af19-c4b53599bbb7", "value": "T172F5BEC6F7C8A96AC4F75332C9395AE2454B4C268B43DF936D14363C18BB6C45F4AAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246303, "uuid": "f03a960d-3e5c-48d0-9d37-452e2ffa2f56", "value": "49152:CauUXJpx3aV5aLY9dupx3zAp/gOEKEyx/Xb9C5gbk0gTwrIW6oxQ4hMUzCmLpI:h5d3araLxy/gU//bDgTwrIIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785246303, "uuid": "38420a81-d8f6-41f9-869e-0e9da9aea367", "value": 3352320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785246303, "uuid": "bfbc0270-9b83-42bf-96dd-10cc257c25c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246303, "uuid": "e1757eb0-e2e1-4d96-99ed-0498313d68c0", "value": "eb.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12201256-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785245674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245674, "uuid": "6593d08e-2bbc-4704-93d8-2d0912d99c11", "comment": "Malware payload (PureLogsStealer)", "value": "602f19d79ed622fbefe826da2fa006c7", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245674, "uuid": "89000692-1b8d-4393-96ff-4ed314422545", "comment": "Malware payload (PureLogsStealer)", "value": "0cf715d47bf25c5ca920110d091807c3fddb2bc14b45701fd2b36648e5463826", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245674, "uuid": "59df500c-4c78-4df2-95e3-d460e055a324", "comment": "Malware payload (PureLogsStealer)", "value": "571fdf91999bf147dba18c99b3ec09af120a7828", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245674, "uuid": "8391c02f-cb39-448c-a4e5-2ba61e98e9ac", "comment": "Malware payload (PureLogsStealer)", "value": "9535fe14432b9871d39189ae779f7f77c673f2368d74b204ed00275f435d4e396034f1d13cfe79dc04edb628c766b09f", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245674, "uuid": "6422330c-e3ea-42c0-b78a-80fe8bce0ce6", "value": "T1EBD5DF14A3E801A4D977E638CA959333D6B078969330E58F0A98D3162F77ED19F3B712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245674, "uuid": "b3fc10cb-e690-4222-a936-c2af6f717df3", "value": "bc5915915ad1a7296140438aea2928df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245674, "uuid": "d920b64c-795b-48bc-b783-8e0c2966c2a8", "value": "49152:E40raN2iCOlmxkH1VHU7B460m2tM/6a4ddWCBvq1s7gsx:F0ioibr7a4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245674, "uuid": "c935e70f-8674-4ed2-8f32-9196e800691b", "value": 2904064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245674, "uuid": "3663f697-d838-40ad-957e-c723516ebbff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245674, "uuid": "9a350a70-5866-4b77-9ef2-63a8f27c05c1", "value": "0cf715d47bf25c5ca920110d091807c3fddb2bc14b45701fd2b36648e5463826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0003003-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785224437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224437, "uuid": "3deb4fa7-0e16-4bac-b659-d290e9ad8446", "comment": "Malware payload", "value": "7a77393ee55080f2cf365afd00a12b6d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224437, "uuid": "4e2e50a6-762f-4427-b7ea-3757c16be8c3", "comment": "Malware payload", "value": "0d6e1d5025a6c55bb077895ae1523c54337d8d5bf501faf9b3628129e2d362b9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224437, "uuid": "e1fd786c-2ea5-4d75-bf24-7f9f24a3bf36", "comment": "Malware payload", "value": "bffa2623a02d73b5a2947c4cb33f9eb962c4ae7f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224437, "uuid": "d3bf9556-c08a-45a5-bf9d-2799eac11ba7", "comment": "Malware payload", "value": "792db9ac00c5d4c426e94b15211ccf1ae4d9b2f38c88bfa8426130f7790586a6f3976a3131ab146e3413a07b3f5bda56", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224437, "uuid": "579170a9-2f46-4c74-8122-95903d1784ca", "value": "T13E6533A1622C3D73B12297A5ED933D994603BBECB6642AE30DF93636C231705E575384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224437, "uuid": "626c4a82-8045-4463-bd6e-2c2a47c0ca54", "value": "24576:OYeXVnwVggk3PQE3Y18I0RH9xKl7N723rfei/E1SuqDybkmYQpe362:OYeSQPQE3u0RKdc3rfe2ubXYQpe3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224437, "uuid": "233ad7a2-6aaf-49fe-8a4a-217badf13d93", "value": 1539248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224437, "uuid": "2b6d209e-4a6c-4a2e-bd65-a6c58994887e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224437, "uuid": "380bff21-8c1f-4ead-bc8a-dc663af5d2aa", "value": "kworker_u8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba99be11-8aa4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785257553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785257553, "uuid": "a27e5ce9-e060-4320-afff-90dbcd9f3f59", "comment": "Malware payload (Efimer)", "value": "9049c0570c16e47553be0dee7b4e02ab", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785257553, "uuid": "994eb8ad-3961-4f63-a77f-a84a5bdf9271", "comment": "Malware payload (Efimer)", "value": "0d7b6965d455ee7e00ba279a77a299caeaf7c872d863738d07aa52139c1ac1b1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785257553, "uuid": "b2a922ad-8ffa-461f-8fbb-9ace7a892004", "comment": "Malware payload (Efimer)", "value": "711cc4b74cc31ab3a585f34837c2dc4cfb3a9f05", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785257553, "uuid": "28f1b98f-d42e-4a30-94f6-dc3af16295ae", "comment": "Malware payload (Efimer)", "value": "9662c3ec70c876e0a2dcdd37ce3f90546e692217da0d6d48f50a5a7ac9f3b67398c2397e95af76065153c2a9a0a1659b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785257553, "uuid": "f1eba185-2e32-47ad-b242-4949011b03d5", "value": "T16EE6331C6AE421EEF6B38139DCB34648D8AD74324331C68B4BE15BA5AE473D04D3DB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785257553, "uuid": "7394c7c5-72f5-4126-8603-095291643a48", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785257553, "uuid": "5ae52d2a-1d99-4aa3-a682-86345cc01108", "value": "393216:xSS3BGCDnXY/8H2EgrZWtPXMCHWUjXBcuI3/PGTAI:x33BGUXBR0ZWRXMb8XWH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785257553, "uuid": "7bca0c39-2d56-4862-a96e-8da21d323211", "value": 14331836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785257553, "uuid": "130d2fba-8a6c-4981-aadf-261519fa7642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785257553, "uuid": "059d6c9d-bafb-44d6-be04-7da4c117b59a", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4cec43-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785224270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224270, "uuid": "636ef5e5-4c8f-4728-b63d-7dd410602595", "comment": "Malware payload (RemcosRAT)", "value": "bbcb0c52182cb32836920baf134e427f", "object_relation": "md5", "Tag": [ { "name": "46-151-182-127", "colour": "#7785DB", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224270, "uuid": "8dd2c17a-7e0b-4ead-a5a0-96d9d2cb2025", "comment": "Malware payload (RemcosRAT)", "value": "0dd257b683c512d002b82a0afb4a214d020b2034d33dcad418f59113130a67b5", "object_relation": "sha256", "Tag": [ { "name": "46-151-182-127", "colour": "#7785DB", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224270, "uuid": "0800fb1f-ff4e-4bbf-a689-6e0738353535", "comment": "Malware payload (RemcosRAT)", "value": "2964af605d79fd18c92c625cf3e59b010351b7bf", "object_relation": "sha1", "Tag": [ { "name": "46-151-182-127", "colour": "#7785DB", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224270, "uuid": "301f46dd-7443-4f06-90b6-2fe5f11a54ba", "comment": "Malware payload (RemcosRAT)", "value": "70007c6096c3e9fd3d6390dff91ca9e6ae35c7b7875714cd724380d407242b311610c8e6fd051dfc575048c6e4e92a08", "object_relation": "sha3-384", "Tag": [ { "name": "46-151-182-127", "colour": "#7785DB", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224270, "uuid": "479af17a-81be-4073-bdf8-438e99ccfc31", "value": "T1ADF412D20A45891845F2FE21D2E8EEE81B0AD95714A733DF97DEC4FA4D228D1E433E19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224270, "uuid": "970fccc2-a2ac-4fcc-8bc2-87e55e359d74", "value": "12288:KZORxM639X4TCVhWMM6jnYCdNYdqXfrQYEdP1oKMXAG5HcIDtFfL1Io5F:KYN2EjZdzfrQYEdP1oWqBtgo5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224270, "uuid": "1c0b45fc-128b-44e1-b1c9-322efb32e7b6", "value": 756529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224270, "uuid": "6f4a9a3f-034d-4664-b15a-4124ebac2347", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224270, "uuid": "13074aa4-5362-4b32-b236-f62a3d1724f4", "value": "Dhl Invoice MNLR002855244.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b15b85-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220977, "uuid": "a8fc67c6-533a-44d6-9ec9-d6d3b4c7a0dd", "comment": "Malware payload", "value": "245f70850a217973a7e135f3c973d320", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220977, "uuid": "d8e2332d-335d-4e5a-a2b0-5477dfa1ed7f", "comment": "Malware payload", "value": "11d8c645650a699b331879950d20cb4ed4bb4ccb16dcb7e405bc79e7a24e3352", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220977, "uuid": "9eccc741-7350-473f-902c-9ac13e8e1f74", "comment": "Malware payload", "value": "f21ddec476e2641214564ae2a608020f1e296a1c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220977, "uuid": "c13da9c7-f517-4aac-a02e-573c09577220", "comment": "Malware payload", "value": "691344ac5c8aa7949fb591b8344087fbc0a27d7b93a66146c005657914aee0f077addfc9e5cac51788deff98a0c7f47e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220977, "uuid": "f56dd440-a5a8-4449-9353-8a7bc379899d", "value": "T1C672D0FF9D489901FCA389757A9B25C9D83FB08A927ED9C45043B56E7CA8EAC10C1316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220977, "uuid": "9a681f86-cf92-451f-8365-be22b629b45b", "value": "384:SoC5NR6OnOxBKp0RJ9lQzSj4NPxKJkCPTd21YQEQzBexm19IZ5r1Ba:E7R6cHuQsaPIuwd2uQEaexA9a5Bc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220977, "uuid": "2f0e6639-e169-48f3-9835-c7671a64c8d3", "value": 17073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220977, "uuid": "f6f3d1ba-c0b3-476b-bc8f-274611083111", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220977, "uuid": "a4eb0f8f-427b-4207-a8a3-a7c7033cdfb0", "value": "images_20260728_003313.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5487333e-8a76-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785237625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785237625, "uuid": "240280b7-06ef-4316-97b0-dcaea0aa4acb", "comment": "Malware payload", "value": "33381fdf911ad9048fd6f595b4159ef5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785237625, "uuid": "3b8d487d-8937-44d7-89a8-0a88acb9be90", "comment": "Malware payload", "value": "12152ab61c7f2e746585ee1ead79f4e02347aac2cc41f80d32a9c7e04da31851", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785237625, "uuid": "8302c064-b2de-48c8-9249-69ac1967d43f", "comment": "Malware payload", "value": "f2c1c6a4cc716e781628388b5a9636d597131e92", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785237625, "uuid": "bbb02163-1365-4c99-b21c-2a75b686709a", "comment": "Malware payload", "value": "26d7151f9cbb22d8205557abbd8c00bb6b3fb7a28fb6b216c992550c3800c566fad1bfafb28cdf11b97f7fce586916a9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785237625, "uuid": "287925ee-d48c-4a08-a11c-762bf3771892", "value": "T13A235C652A857C14AA98C8371D7F2F0CB9A943E6320452DE7FCF3CF68C4AADD910961D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785237625, "uuid": "5ac6d71a-708e-41fc-beb0-a0448786840b", "value": "768:CJFWzZx599GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:gkz0cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785237625, "uuid": "3a69ac36-d1ae-48ef-b3bc-3327aab2fe8e", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785237625, "uuid": "4bb7b053-05bc-4373-aaa4-78ef0ae8201f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785237625, "uuid": "ff581df7-4e93-4881-9e6e-c3f292ff1a0a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee5fb0e-8a88-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785245239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245239, "uuid": "2909e550-20c6-49c3-8599-1bc77937c438", "comment": "Malware payload", "value": "23153e5eec31be2c644ec0924daf29d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245239, "uuid": "16e52856-caad-4a0b-a50d-e6b83407847e", "comment": "Malware payload", "value": "1332d70d4b5325fc6bc1e575372b5f513e79c5a5079f61337b44f69614463647", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245239, "uuid": "33b89bee-5d1c-4e48-9e5c-6842c40b17bb", "comment": "Malware payload", "value": "0013baaa85c61ecd4897ab0dcaa3a14debe2d39f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245239, "uuid": "06128752-9ec8-4faf-9c43-45c220153871", "comment": "Malware payload", "value": "7ad3b91623d15bbabdd00c5f85af1c6e0cb0647daaa4630ac4f9de78de04d817f757cdae63adae722c3719cc4b19d998", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245239, "uuid": "4ae993e4-4f73-4072-8aed-1d2f570d5ddd", "value": "T14A163338675242D7A803C77B798A7AC5E4EB108DDD2E0EC19CD4F1BD5AB52E1F0C05AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245239, "uuid": "35920ce7-4588-4763-a704-45bad3a47dbc", "value": "98304:5+9tlRYY0W9vS3iJW8Fa9iBFzVq5asDdABm4Vdk:5+91OyW8o9iHMaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245239, "uuid": "f955390e-3c3e-4799-9cd9-0fc1e2178572", "value": 4069458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245239, "uuid": "9d8c9fdf-2e57-4dd3-acf6-630e6a8688fb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245239, "uuid": "29e6300e-ef52-4361-bbb9-1c990ec87913", "value": "exec_binary", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03bf92e6-8ad7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785279151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785279151, "uuid": "3fbd3c87-3af2-4edf-b9bd-aa679dd09851", "comment": "Malware payload", "value": "95ab435432ad8bb2853d3fa8782acec2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785279151, "uuid": "e0c24d47-ef8f-4815-aa71-6ad9a178b74a", "comment": "Malware payload", "value": "1441e39c7dd359145a88309bcf004282ce178df47635b5be6b48dd0e2ccb58a0", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785279151, "uuid": "74cee54d-a2d8-4d0f-95da-df199ce43e22", "comment": "Malware payload", "value": "9dfb638fe8b4300ae278ee5f32ecbbbdb4f93895", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785279151, "uuid": "2dff4c3a-dca1-4ee2-b0eb-4ce583a4e0d8", "comment": "Malware payload", "value": "0a69addeb14138d045ff42357159430f6d69f600498a775f31d0ee4cd7b3aa2d71afbba14ad0a633b5001266496ff739", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785279151, "uuid": "62513d5c-24ac-4a4c-9ca2-dd8e3ec52fce", "value": "T1D1E63348F2D025FEE773423DEEE64599E0AEB8510772C9DB576887906E672E04C38363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785279151, "uuid": "e0e228cf-c8b8-43b3-b4fd-032819a6a83d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785279151, "uuid": "a850bafa-ab87-4c9a-a526-ffd5bab274b1", "value": "393216:lvj9alSt4ErJiN7oYE777LdnXMCHWUjXBcuI3/PGTAI:lvYlSt/K7oYE777LtXMb8XWH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785279151, "uuid": "336cd249-824c-464e-896e-8579546cf150", "value": 14320325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785279151, "uuid": "3f2ca88f-a406-4b54-bf9b-e119e63853cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785279151, "uuid": "05b928b5-927c-4922-8cc9-cd5715f68fdd", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ddb95b-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220738, "uuid": "80a67a78-0c65-4917-8ad4-faa9af98de8c", "comment": "Malware payload", "value": "feda3c5aa4a6b96660fa5c53541ecdc3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220738, "uuid": "72696356-d060-4a79-9e36-0b0682de11ea", "comment": "Malware payload", "value": "145e51a940870eed3e4ecff74f662207fbae6d5a69a5fe4e845a35299768bc3c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220738, "uuid": "6e12d7e5-3d9d-43c1-bb8e-29c1f8b33fa3", "comment": "Malware payload", "value": "2a8d03595797ac63221287e776c5ed438adae54a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220738, "uuid": "26d6d3fb-4e3a-4065-bd11-faca089cc3ef", "comment": "Malware payload", "value": "8687f2cb41838869092d6ff07535ec274bbe7579493121b332e3cc39da809dce993a4c13ab9cfb3f65f775436a0f1999", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220738, "uuid": "0b7335f9-8441-4b9a-9577-6e333779a594", "value": "T14D52C09197F5D55B82F3DC39BA69B74F9A2C88A9007605CD698F78EE64082D792C1042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220738, "uuid": "601f65b5-a4d4-4af9-941f-f3bb362bb2ff", "value": "384:QN9jAKqr7Ge0lHA1L9BSkUmRGVMv1EJjQlWxt96Gh4yPwZ0EslQ3iu/:QNWFme09WR0s1ESlWxtQLQusWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220738, "uuid": "81a7b980-2e51-47be-af4f-58c738e94112", "value": 13680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220738, "uuid": "b9a88c33-f5fc-4e31-971d-0c0f5814235d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220738, "uuid": "f458892f-1e25-46e9-9e5d-10b0a88f0dad", "value": "images_20260727_080336.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46e3b72-8a4e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220713, "uuid": "49815c03-df57-4bf3-a962-754f9ed8ad81", "comment": "Malware payload", "value": "fe1451f6f0e1fabd09d1f56d823ca654", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220713, "uuid": "5e08482a-7f3c-4262-add2-cb51ad5b1886", "comment": "Malware payload", "value": "14f1a073150fdd6f6ff6dfc61133fa536697898c23b493fe824e4210afb2bb90", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220713, "uuid": "b6aea961-76cc-45be-9f27-5b46ccf1a33e", "comment": "Malware payload", "value": "4b1e42a82fb15524e5d0f65611b79395c656024a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220713, "uuid": "8d6c0eea-5385-4a67-9fcc-54da7692fd02", "comment": "Malware payload", "value": "6a098fd1395d3ea0579034676b552e045021b1c3a218598e2472da6979b6028a3efd0220236d66a8c1b87657d60e6144", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220713, "uuid": "964ae9c7-d12c-4004-b57c-8149844aa2d3", "value": "T1E772CF1BE0EF36E3F60AC7A9920208681CC25FC2C4CA9BB81AB5625E37D9571383A151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220713, "uuid": "d1452540-d024-4edb-aa32-e200571c2f7d", "value": "384:XZApNMK38YKIAM2gr9VF0DcA/IgjwTz6O:XiZ3DnT2Ec9/xi6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220713, "uuid": "e41f063d-4db2-4330-8c5b-c400ea72ec7c", "value": 17347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220713, "uuid": "969225b6-e60b-4cb8-a2be-e85e3fc3d2c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220713, "uuid": "5b9fd097-83cd-4aa9-bdd6-171632603818", "value": "images_20260727_152211.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a04372-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785211072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211072, "uuid": "e1adfe52-a046-4a38-be07-6dbe8476ea50", "comment": "Malware payload (Mirai)", "value": "0a2bb51e8215a55dfee41bd79af35eed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211072, "uuid": "c0c7e795-d964-430d-8eee-cccef74957ab", "comment": "Malware payload (Mirai)", "value": "15bb1fe98d7b2b895ce16bd6e4c2ce50072fd34c6397f03a8cdf571308197296", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211072, "uuid": "d4d595b0-a6d9-47e4-936d-7985d5183504", "comment": "Malware payload (Mirai)", "value": "74bc408666d917053a9233c99e16a92df739dafb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211072, "uuid": "cfa55219-3b6c-4e21-aa1a-9b25872bc1a4", "comment": "Malware payload (Mirai)", "value": "43255903a4e0ae5e3ed17681032888933f6ddbe9841ef6702200ca195d1b426e1df0eee25b1a039c4d34b7b85f480517", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211072, "uuid": "05b426e7-ca88-4106-898e-57156ce95544", "value": "T16FD45B02EF911FDBC8AFCE34892E431705EDC98706C1A72561BCCA6CBB9925A4FD7548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211072, "uuid": "48ad9732-74eb-424f-9c2f-1b6631a3afd3", "value": "12288:XS14KJg/ImvmdmMLWaSS2XybNk+ElGe1svSWEIOLsqjA/PnIsaa/fWIpo+Xxh8Ex:6cImvs7f1d1mCRhKzH/EC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211072, "uuid": "53aa308a-5fff-44e7-a6f5-c51548dc46bc", "value": 651188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211072, "uuid": "b5c3dab7-49d8-4503-9d3d-1520d4b35525", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211072, "uuid": "b315d4ac-cac5-4034-bf40-080660c87aef", "value": "dlr.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbb2ce8-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785211038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211038, "uuid": "6902336b-9a21-4311-bc46-30ababeecbb4", "comment": "Malware payload", "value": "9578d9ef6f1e7babb26041f26bbc7af4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211038, "uuid": "a611e9bf-e6f2-482e-9a90-cfa44a2db49c", "comment": "Malware payload", "value": "1750cb0df5c35cde3a22081d0c1b5911c3875efce932244c906cb0c961cc5e30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211038, "uuid": "11ae021a-0ff2-4869-8fc6-0e5725857bc2", "comment": "Malware payload", "value": "5375cf5f059e4651654bfc13419fbaf3840e73f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211038, "uuid": "097b638c-6ed9-427b-8c71-79020015f640", "comment": "Malware payload", "value": "eea99cea0cb05e620c8ace00c19af9b6d73c145079bdd1870d16e2d302692b33bfd9f19751af668183f95e9ca53b57a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211038, "uuid": "ff06751a-427b-4b52-b753-ee2820fccd42", "value": "T133955B57BCA505A9C0AEE23189A29192BF71BC451F3227D73F50B3782F72BD06A79704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211038, "uuid": "f8939f43-ae0f-45aa-981b-aa31561084dc", "value": "24576:OtjP/cLbznrfndwgYocR4rrafpkb6NuojRwY8RHB0zBNi:OtjPULbLjn2gY+rrowRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211038, "uuid": "77bd1ab1-2ffb-4386-b95c-cdee16ac2bf3", "value": 2027780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211038, "uuid": "00c73e4c-a963-42e1-a271-a64fde0c8458", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211038, "uuid": "5416d93e-02a0-4a31-a125-fc1702809eb1", "value": "boa_attacker", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd1019c-8a6b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233183, "uuid": "472f3d3e-5fd2-46d9-b979-687a1cd4a20f", "comment": "Malware payload", "value": "c83f99e078b9fb8b2b8dc0cd09976bcb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233183, "uuid": "e7a7401f-2a4f-4a2a-9109-db235e09d19a", "comment": "Malware payload", "value": "17938452b5950a42f607069d90de10ab58f230f661d43f5ca43aa528d513b20f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233183, "uuid": "7788e5e3-84f0-4d34-9944-2408388a01be", "comment": "Malware payload", "value": "fbbf799a205166828c8e3176ac62d84ff41a583f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233183, "uuid": "84a694eb-7bda-4ccd-9a3d-791786426ea4", "comment": "Malware payload", "value": "955bc5a015730b5a10cc7d3db9be50ff3660fff53495814ee5ee6c8fa2c80f9e2923408626784159bb36428a946d95a5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233183, "uuid": "e145f1d0-39b9-4d0e-baca-15247f639a5d", "value": "T188D19FE992BFE810E8F6993B53146E1B10AC86D46EE514946B0C970881BF0DD865B5B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233183, "uuid": "9c0f2640-66dc-48f3-8091-ddd954644bf4", "value": "192:a/Tuw55kWz8AakUi+92tRdvZe5jgB7TCBj04oZoJkgb:a/TH5ngACi+KvZ9S048oJkgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233183, "uuid": "33d7d10c-5b56-4fab-b6ca-f5f71df6de10", "value": 6667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233183, "uuid": "f6402b4b-5086-4080-8639-213e7f43ed72", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233183, "uuid": "da64cadb-14fc-44e5-8d2b-31a31eb1b095", "value": "images_20260728_060507.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a49d9a-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220798, "uuid": "2a9173fb-9333-4a5e-a35b-3ac8633d8a44", "comment": "Malware payload", "value": "a52ff248acab0756111d85876c70215c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220798, "uuid": "da215de3-cb5b-4ee8-999b-296816bb1466", "comment": "Malware payload", "value": "17c0ea55fe020b712ca2b6aa8ffeb5d0ac68bc27c91efc342ba3625584c45d7c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220798, "uuid": "a921f580-155f-4898-a239-be3be12bea19", "comment": "Malware payload", "value": "e996913684e30c25cad430ef5a4045b2f4664b5c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220798, "uuid": "303e4e54-2e52-4a00-b895-fec87b109a86", "comment": "Malware payload", "value": "31648732d0d0deb1469a35801429ce3473a036ade1227f7edf5fcdfc67ed07e2b444de742a888406e15e5323333f9e9f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220798, "uuid": "e92447ed-2ede-4fc8-8b7a-784f903ff606", "value": "T126918EB891B5B043DB7A32F02062BD0E35079750EA8978D0BFB7CA1648BE42975C7C32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220798, "uuid": "1f66eb61-e98f-4bfb-ae26-018243362a94", "value": "96:761Y9lpu8zTEHO0pJlD/G74MuJQVvA3b6UrHAGehULr7/:76+93pzY/DlD/GjuJQVvAO09Icr7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220798, "uuid": "7fd255ef-6375-4baa-9e55-baa382e304bd", "value": 4378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220798, "uuid": "da7bd6bf-8aa6-48f9-8508-bad13fecff64", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220798, "uuid": "5485e8fc-dfa4-4cdf-ab0e-5dcc18b234c9", "value": "images_20260727_235043.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e842f2-8ac4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785271376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271376, "uuid": "5781900f-3b2a-4adc-a1fc-b4130aa4b530", "comment": "Malware payload (Mirai)", "value": "c71ad53df2819f5cef21166aa022cbb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271376, "uuid": "0731b390-2e61-42f0-b2ba-d1e4532a629d", "comment": "Malware payload (Mirai)", "value": "194b02279c7aa385261c8badb611011aed5677311dbdb96d26e7b5951205d354", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271376, "uuid": "65753cf7-81e0-4c81-8e1a-2397fa40278d", "comment": "Malware payload (Mirai)", "value": "45c49ad92fe0ca3e2f4331886a9a2ff5babd8fbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271376, "uuid": "79f8a8c1-b0e2-4cda-84ab-04d16285ac6e", "comment": "Malware payload (Mirai)", "value": "64460b85456ee1e49dd049e0388250b8dd12468c350ea6853948a335e7866a10b0d3f5f0ae5b053094e606cf9259c68f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271376, "uuid": "75fec2e0-5a13-4337-b601-571443da93ac", "value": "T177633B66B9419F16C2C16677FF1EC389332763E8E3DA7203DD142F69338B42A0E2A551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271376, "uuid": "33e6d15e-8e81-4999-8ab2-18982e0c5810", "value": "1536:R32EjYaoQeTvjCZc6QY0dKkhrUBT+JmR94YAoZcom1FvEoX3xWSBM:R32EjYa7eTGUOkhUB6JE9Ea/QFvEA31M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785271376, "uuid": "f43458c9-55b5-46f8-a84f-5aca2c4674a2", "value": 68600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785271376, "uuid": "fcec3b01-8b3d-4b31-8b28-193c0d9a8bd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271376, "uuid": "77e71ada-6b7d-49fe-8c6c-0ed9d1919fa9", "value": "Lrtt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f70a37-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785224397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224397, "uuid": "df525c1a-4df4-4d5c-9944-92eefca57cf4", "comment": "Malware payload", "value": "2dfa3ca7498df35f40e6cfbb2e5b16eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224397, "uuid": "7dcb7ff4-35e0-41df-b66c-48996a9cdc0a", "comment": "Malware payload", "value": "1995c05e0c1c23e171150a71df472bc3564376468f803c99768f4e9b1e942f2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224397, "uuid": "af7a0b17-a636-4809-9e48-de65fb77f31d", "comment": "Malware payload", "value": "0087911c1dde391e502e64b3c1f9e2c1d9c49cd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224397, "uuid": "e0e6707d-94f0-4118-96d5-8457795db5b0", "comment": "Malware payload", "value": "bd6dca0253ba993a455a19f1945900b3ea415a46a1a8a8f9100963b336f8a280e7bd2452473f9c607a8a0e12a6ea3cfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224397, "uuid": "3c897ae0-f8a1-4b1e-b3b2-0f69342db4f9", "value": "T129260857B8D24942C4E83677B8BE80C433635EBA9B8A53576D05FE383ABE1D90E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224397, "uuid": "2eed165f-297c-43fe-8d5c-d28a95f0a58f", "value": "24576:bgYqcZad+KeWLNA3zwPBMOhZKXIItRZjZQGEno7AAZLpv7oW6hQ9nKVvvP1PyzDz:boNiioOax4U/eto7rH+4jG0OY45E7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224397, "uuid": "73792b96-274b-4f73-ae3b-c836c1920e64", "value": 4784276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224397, "uuid": "f94bcde4-3103-4198-beff-400815a3dd3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224397, "uuid": "748c3f74-e46d-49d7-ad1b-49264981a43d", "value": "bioset0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eae4503-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785224435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224435, "uuid": "5927f16b-26bb-4d34-97c9-e6be161f5063", "comment": "Malware payload", "value": "96eb5b276b6fc880c1aab7bf2fddf2c2", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224435, "uuid": "b863dd41-c82e-4550-82dc-82c500f4062c", "comment": "Malware payload", "value": "19c4152a76ff1db644988f3ef8d01215b313aa4ceaea9302f5196d747dd6131b", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224435, "uuid": "5dd12376-c070-43f0-be06-75831920b491", "comment": "Malware payload", "value": "b7dc41ea52d969a2f94984d4136c017d56750cf0", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224435, "uuid": "4512aeb6-aac2-4bfc-8ae8-6e56ee4d5747", "comment": "Malware payload", "value": "dd3a9c65200287e072548dde4f43ac70650772c533e3edf0a759200347705b9873928d71d135cbe7241f821960216253", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224435, "uuid": "a974bc97-f88b-4c2e-8881-ce800076f554", "value": "T18C553333CD407B6AA08D64DF30D0E6469B90DFB88CA091495C13D9BA65F682345BFE7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224435, "uuid": "0c8cc0dd-df78-431b-8827-4bd66113bc20", "value": "24576:9OG6PLCLlYZPi12PCRsqkXFhwe+IdMKJTf8j6VtxdAp5fL:9OG6PtP5ksqkXbhMKJTf8Ga5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224435, "uuid": "b62dbbb5-93df-49d9-849f-0675acbf19ca", "value": 1357064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224435, "uuid": "130a65ca-e73b-4cf0-b254-9986ee60fbb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224435, "uuid": "58d2b453-c897-48f0-8e96-ef76530ecd5c", "value": "kblockd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28db7acd-8a8c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785247001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785247001, "uuid": "43920ca0-36a6-40e7-8396-eb0560fda2be", "comment": "Malware payload", "value": "d348e640d6018883443e6c71e53bf424", "object_relation": "md5", "Tag": [ { "name": "EncodedInjected", "colour": "#1E1E71", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785247001, "uuid": "285f4cc4-a725-45c2-b676-0035a02102bc", "comment": "Malware payload", "value": "1a54d4947e91761b8bcdceae7ffaa9ad46447c27d426c20750606319b85abd79", "object_relation": "sha256", "Tag": [ { "name": "EncodedInjected", "colour": "#1E1E71", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785247001, "uuid": "b74bec14-e115-46df-a3da-ca3f3da77383", "comment": "Malware payload", "value": "8f709c46d1017d2ad54be6943505356df8dbcd81", "object_relation": "sha1", "Tag": [ { "name": "EncodedInjected", "colour": "#1E1E71", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785247001, "uuid": "35ef16e5-2c1a-49de-b311-5814df746761", "comment": "Malware payload", "value": "b8f419f11e587dc6c779186ff3ede3cea82bc44876e0f6a84ca80947c5d88c87138409397f38f6aac8b5b571bdc9a795", "object_relation": "sha3-384", "Tag": [ { "name": "EncodedInjected", "colour": "#1E1E71", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785247001, "uuid": "157429ca-8a20-4b42-a72b-7845878a34ff", "value": "T15FC18D1D7E2AD31D847E1BA800D485094C4B9D86CF18B249E0484B475DB2FFAF55E1AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785247001, "uuid": "d0b0b712-9b7b-47a8-ad2c-b8394cbe420b", "value": "96:AZA/b4osDOwKQcpQoRxwq2Tn+/BFC53h9jLAzfQYov6j2c8S4Us1Uq2GxOl09i02:QA/xhGKF2TlBLAzfQYoyjdF4/2d02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785247001, "uuid": "4cfeec7f-2580-4067-84b6-ab7f33757ea3", "value": 5649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785247001, "uuid": "f46fb0a1-0df5-41d2-9f2e-17c73b930023", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785247001, "uuid": "9b8ac390-5615-4c26-a036-17235529c3fe", "value": "cache.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67045fc-8ac1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785270028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270028, "uuid": "a72d6820-5373-44c4-a197-b454709a83e4", "comment": "Malware payload", "value": "1eea14a025deda739b2d66985ee8d7bd", "object_relation": "md5", "Tag": [ { "name": "103-193-173-83", "colour": "#A458EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270028, "uuid": "f969366a-1ca8-44eb-88c5-f85fc0fda8a9", "comment": "Malware payload", "value": "1a569dd1087367b863590e8e1a6e8755a368473d86ebd3213b9be3ed971668e5", "object_relation": "sha256", "Tag": [ { "name": "103-193-173-83", "colour": "#A458EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270028, "uuid": "7d46ad4b-4c08-4753-ab34-f2aa2b2119d8", "comment": "Malware payload", "value": "205a898f45c962893751fb40e40678ec51fde2c5", "object_relation": "sha1", "Tag": [ { "name": "103-193-173-83", "colour": "#A458EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270028, "uuid": "aef18e59-5df9-46b5-a972-cd240f75c445", "comment": "Malware payload", "value": "108acfe75201159fe792018f74f8c87973d4833b76331f8718a0bbfcbf33a732056773464d1692715508a3b4d9a01354", "object_relation": "sha3-384", "Tag": [ { "name": "103-193-173-83", "colour": "#A458EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270028, "uuid": "18e84714-d427-424d-87c0-73b6b2b566bb", "value": "T146A59D56E27360ECC66BC1708B5BEA67F674742C41207E7B9990C7302E72F50671AF2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270028, "uuid": "6d7b96bd-c4a3-4f40-af04-09f6894856f1", "value": "e5288f788faa45e831987b5d5eeb91cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270028, "uuid": "83098259-8719-4234-bb2d-c38e8e0e004d", "value": "49152:rmNkvLkwZbfxcQvMb96IlAl8eDdX7nPHa0o:BbfIdPei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785270028, "uuid": "60074b1b-38c9-485b-a158-a66e3fa2f035", "value": 2131456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785270028, "uuid": "18ba0d3c-7640-4349-819c-47b6922bfecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270028, "uuid": "0658da7d-9ffd-4680-9aad-4faf7c3882bb", "value": "payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a86b25-8a4c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785219445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785219445, "uuid": "04c0a60e-155d-4198-8f8a-a8884205150b", "comment": "Malware payload (Mirai)", "value": "b9248f304c7e5b0bd7ec118270e4757b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785219445, "uuid": "86efaf7f-79ff-45d1-9ecf-7321fd2f1f78", "comment": "Malware payload (Mirai)", "value": "1b489318b98bd4e79e9bc14ec7abdf36802bfc352544c3d4bd5f53da923dc191", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785219445, "uuid": "a4c0d6c4-a284-4983-aea4-ada0f278ed78", "comment": "Malware payload (Mirai)", "value": "e92aa7a4deaafe02ecac6fb378643e6156c245d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785219445, "uuid": "2d064864-005a-4dba-a32c-5e1294a19a72", "comment": "Malware payload (Mirai)", "value": "08eb647fc812857c6150b0bef6034dd0d2db679f25babaaa51fa54d494268503ea9485a43c38ec162755917b44ec8d5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785219445, "uuid": "c923c7eb-75cd-4d18-963d-d10bc9f52a83", "value": "T10ED46D59FE5E3C42E3CBE3789B4E83E1B22BB194D32391E33942524CA5C65E9CBB0515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785219445, "uuid": "d9a3d433-bc27-433f-9ac6-59022e33afab", "value": "12288:5S3L8uTuatlsv6Cjd4nsqg2Uo04Vw5VNlsC:M3L8ItlqynsQOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785219445, "uuid": "5df34ecc-320c-46e4-8bab-a0d864b34b39", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785219445, "uuid": "e7ec46af-79c5-4757-9b42-4c38ba755807", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785219445, "uuid": "62f5e36e-92b5-4b32-a45c-c2bcdd584cf5", "value": "real_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc3a0ce-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785245962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245962, "uuid": "db5ed7f9-ab17-421f-bb87-4898b633c6e6", "comment": "Malware payload (Mirai)", "value": "2d9694fc4fc814a9421b5c751b5c1810", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245962, "uuid": "e2cf03e6-d763-403f-97fb-fe7c298c9af7", "comment": "Malware payload (Mirai)", "value": "1c94c64065e9bdad64c5f705614d7f5d2edc4207fb339f329965a441fe345299", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245962, "uuid": "b2386d4e-10f1-4492-ac86-aca777ca7f47", "comment": "Malware payload (Mirai)", "value": "ec1e74d2a7b4827984d9c4b9ce44191ca501c254", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245962, "uuid": "388d9927-5c42-4387-9b34-97901832a3b1", "comment": "Malware payload (Mirai)", "value": "7dce57963b8492e97f5a1f19db311d61c08e1a7c4265f4e42b8cf32e7ab698a5c3a0d057aaea1964aecbb76ab3beeeab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245962, "uuid": "9dd176f9-2220-4714-ac89-e0de555ee7c3", "value": "T15A631A66B8419F16C6C16277FF1EC389332763E8E3EA7203DA152F5933CB41A0E2A555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245962, "uuid": "a719329a-cdb8-46fe-a0fc-a3d670dfec1c", "value": "1536:e2U77Q0TvfGZc6QY+dKkhrUBpRJjuI8YmrZcGAPFzEoXNp9xp8G:e2U7M0TOU4khUBTJyI2NtwFzEANbxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245962, "uuid": "fb345743-7d5a-4ac7-b14b-b196b17e82ab", "value": 68000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245962, "uuid": "1b570881-d7cd-4bbb-8fb7-55e0b6d2b850", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245962, "uuid": "99aff3df-b8fb-409e-986e-5246d1eed073", "value": "djr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a86f6cf-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220750, "uuid": "6914f23f-1c50-45ce-83dd-8697bfb3a7f7", "comment": "Malware payload", "value": "43c8bd918c5333dcad29ba3225cb040e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220750, "uuid": "97cbe652-4056-44a4-bd28-cd854b45e3c8", "comment": "Malware payload", "value": "1d22d8fdadcf5a2d5d6735f0281b29d0ae33408d1fcf209eb04e7906ec8ec871", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220750, "uuid": "dc3e9690-cead-4a60-ac7e-a832ccf73cc6", "comment": "Malware payload", "value": "e7c74e0a5edd49d1d47e37cd0a9e42c4d6be9feb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220750, "uuid": "4750b6a0-e73c-44d8-b3f2-b5904f24a0d5", "comment": "Malware payload", "value": "c86b51c281e9409b7318c6bb6f7fb2039fcf8d45f35c8f2881a84cf472cda7c5574093a7a6f8b9bf11c0f98b70a29551", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220750, "uuid": "594a77d0-a282-4f61-9572-1e4042ffbff3", "value": "T13772BFB8746B0055D1A3E66AF4993E986307C7C2955B04C993EE6FF93C2AD1C9C4B1C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220750, "uuid": "ce72569e-0078-4f86-bc07-a7ed8f291e27", "value": "384:ywRzPQAhIOjcM8GW5db6NFz5JELRLuz6MTDuSxZ:HdP1hhjcAW5dbM9fqNuzISX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220750, "uuid": "7658a6d5-dade-4c6b-b91f-9a05f6373286", "value": 16669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220750, "uuid": "18b1fa1d-e2f2-4efa-aa4f-486182d0dd05", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220750, "uuid": "5d39f70a-ba1d-437f-8f80-1966e6939f62", "value": "images_20260728_031703.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b7030e-8a96-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785251349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251349, "uuid": "6c95d48e-8997-4b67-a15c-08b292937be2", "comment": "Malware payload (Mirai)", "value": "15331e3cefd2056e5e730a54aa9952f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251349, "uuid": "1ba29a50-fa43-4f71-9319-a381fcb45c89", "comment": "Malware payload (Mirai)", "value": "1d406685758010d9fa7d36b213f91cc9ff1c4096bfd5a841b7549e8e54ae6d67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251349, "uuid": "b508303f-288b-4338-9057-0d7a463b143e", "comment": "Malware payload (Mirai)", "value": "dd32f5cbc6bf90a6b10c32aec24b1ebd443c54d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251349, "uuid": "8ac47cc4-2250-4941-8883-d8c110088d8f", "comment": "Malware payload (Mirai)", "value": "0fbe9e89b42cd2678ef52260ce5810b67ffaff5b49b718d10b36629a2324e2bf63bc051538b009bd59d95ebe6719690a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251349, "uuid": "44b3497f-72e7-4380-a33c-bf61c1436e2c", "value": "T1FFE31945BC519F16C6C662BBFF4D428D772A17A8D3EE31039D252F24379B86A0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251349, "uuid": "e6c33a9c-50c8-44dd-b5ea-0ee4be20d80e", "value": "3072:SCGTYHmL6YHo3+B5/RHb91bs/wppDqwNtDiQOYMFdJpWBh:S1TYHmL6+5dLbs/wpxqwN9ivFdJpWBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785251349, "uuid": "e68644c7-9d48-4373-9806-ca7b4e305b27", "value": 154360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785251349, "uuid": "778f305f-6752-4cdf-90ea-050f783f8ae4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251349, "uuid": "bb4f9ab7-e6c8-490d-817f-c5d8b2ca4980", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0718d615-8a8c-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785246944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246944, "uuid": "6ee5f542-d92d-45e3-b7d3-aa9629c0aae1", "comment": "Malware payload (CoinMiner)", "value": "ac4f0f8c136e3cf7302b5fd1d6cd6e1b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246944, "uuid": "6f94b750-8385-4135-b0b8-29ed627eedf8", "comment": "Malware payload (CoinMiner)", "value": "1d9bbba8601db0ad5ef2a66b75a1a0f1c8f4c4cb01378bce031d360c9c543f32", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246944, "uuid": "1d40ae1e-c9bb-4490-831a-dc779c9891fc", "comment": "Malware payload (CoinMiner)", "value": "ece7513d91b9fb3d97f1d651cbb6d4ad596f8387", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246944, "uuid": "8732c24a-c252-430e-ab58-675ffde36aa3", "comment": "Malware payload (CoinMiner)", "value": "f0c6bb4a08f48631149fa9d055f1d2fd25f6b5ca863f72714620f6daff7056298f91082685a6dd7281bff1265a62fe80", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246944, "uuid": "31bccfd5-4584-41dd-8668-988801493dcc", "value": "T18132921D6E4B0322EE5144B4E475424A543D1EE3B747EBDBE633D1DB4AC6E4488C0A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246944, "uuid": "c9ef4e65-f278-416f-8a01-e8fb0c21a3f3", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246944, "uuid": "68289ac6-4b04-4ce0-a388-d4ca74262770", "value": "192:QoFeJIS5BHHxSHO8H5epPFJxTEZmFhqm:QogJDHsueepPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785246944, "uuid": "e07e0b7b-0800-4fc6-9ad1-9082a58d865c", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785246944, "uuid": "beabad42-be25-47ff-9375-ea255efe92a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246944, "uuid": "db5da29d-e8f0-4f33-ad85-8247bd8a854d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b746cc46-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221040, "uuid": "350f642d-b8f5-4904-82b1-849e10499ec2", "comment": "Malware payload", "value": "4ed88e5bcf97e4c4e3fc0d3d7464d3e2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221040, "uuid": "b0091b3d-4fc9-4bb7-b9a5-0b87f73881ea", "comment": "Malware payload", "value": "1dabd2e5252d33d41e75f14685a02eb74c4e7a87e50fe85f0f1676a07db428ae", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221040, "uuid": "3c469931-2acc-4ba0-b59b-fe4bbd474d73", "comment": "Malware payload", "value": "ce19956180e5bd7549a6e0b8853bf72551d50bb0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221040, "uuid": "7f86b2e9-fb2b-4d58-b513-f35f3428e53a", "comment": "Malware payload", "value": "42be004307b657ff2a508ba4fc80d7f8fd0ac2ff01442d34e6149dfdd4a2966943a62686cc952f39835254c857a1dab2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221040, "uuid": "b7c20760-a738-47b1-97bb-202801fac972", "value": "T142C1AF428988FE71D75B13307C777EE4D5A3EC991B87DDC143115F90E3088261B8905A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221040, "uuid": "124bc273-8a22-4003-80b6-ef88bf1d9fa3", "value": "192:Jdp6c3f2A9FxDzC5VHZeJUUTP/in1dftd:NPfr9b+ZeqqmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221040, "uuid": "6321a70a-e198-48ad-9cdd-e0e15f07d84f", "value": 6157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221040, "uuid": "ff03530d-3dbe-45c0-85bb-d00f32fa673c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221040, "uuid": "7f52b599-7e68-44a5-afeb-a11f48fdf63b", "value": "images_20260727_065847.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86393fb-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221096, "uuid": "d5217b7a-a581-4a92-8b19-4bd25f659ed0", "comment": "Malware payload", "value": "732c8a83dd6672c8a529431a39e36175", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221096, "uuid": "6ec349e6-4a87-442a-aee7-f7c5b0ccbdca", "comment": "Malware payload", "value": "1e91e0e09df7794777b39bc43401ff32fcf6ba556217cc2d509b10465dd0b388", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221096, "uuid": "94d52878-e1b5-43ae-b3f4-5a9384dce4c0", "comment": "Malware payload", "value": "76a59073f2bdcc4755dffee6ebc83f2e7e40ea72", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221096, "uuid": "5b7c7bdf-7ec2-4944-a6be-ffc4095a2ed8", "comment": "Malware payload", "value": "d8d98503521491c477dde5337998967a839381f8a07991600a8039f07ba874b6d2318a40698a7d26f8e247404b50c166", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221096, "uuid": "617acc6d-00da-4639-8284-e5dfe88c07f6", "value": "T140E1BE5493E6D0B3CD4F349EA9CE19DFB25D1C71EE1690937BF32A7D08619B90510113", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221096, "uuid": "74c3ce35-69ce-4b64-9ae2-78faf069e7c5", "value": "96:qB8Gmjxsxpw1moLZ4NoHwqGjc3kziHOxz+kCWhbuk4ehIiXtXV6:g8KG1moL0oXlkzigzPCuv4eCkV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221096, "uuid": "f86e7358-d154-43a0-adaa-59cd198b362b", "value": 7160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221096, "uuid": "eabedcfb-3792-4e4c-ba6f-367baa72dbe9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221096, "uuid": "7b7ce8f7-e27f-4dca-921a-48c767cd00ed", "value": "images_20260728_051243.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d35638-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221118, "uuid": "87c10d81-73a5-4433-827e-8591212c4b4f", "comment": "Malware payload", "value": "88c6c9a7fb80f65526f3c1ae197cadea", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221118, "uuid": "80a3f33a-1459-4bba-9459-6c72a070ac8a", "comment": "Malware payload", "value": "1eaf9dce3a1ee99c2b87a09470b0bf5088a5cadce796d37c3602766fc7255ba6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221118, "uuid": "37bff1b8-91e7-44c0-998f-3fc2524f9cb7", "comment": "Malware payload", "value": "969a369faccb99a207d3c07fbd4abc40ae774d62", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221118, "uuid": "2091d23e-b338-4945-af08-026c417288b9", "comment": "Malware payload", "value": "3024e8eee255894349323058abebbdd7a34ab51ac8f33364d28d95ae8a4871c125d9d78a232a922cb46517a25b1bda14", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221118, "uuid": "0b020b89-e606-40b8-8587-72442f71ffdf", "value": "T1A252C0CB311DEEE55FB181B516E905110A1C28F3AE3DD80DC94D29F97EAA86D36024CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221118, "uuid": "1d5063bf-c0df-4c03-8dd3-85d6e034f9a6", "value": "192:S+h5paWBZG8C8kZBgyZeBb+2rpOekJACaqlgnp9OCJOqT426imisw83aqVVGt3Vv:SoAKZGr7HZF2wekJAM+paqlswxiGDlQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221118, "uuid": "569fd315-dfa8-44dd-88a9-751530e48348", "value": 13728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221118, "uuid": "f4d23fef-3198-418a-a25a-62ea586d90ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221118, "uuid": "19228580-bd9b-4b9f-a1ea-5cf3f88cdf2d", "value": "images_20260728_021359.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60936c02-8a47-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785217459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217459, "uuid": "021d0795-f81a-4f5f-9463-1dbcfcdecd7f", "comment": "Malware payload", "value": "4e87cb7e710b8b5cd29c8e901312b5d6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217459, "uuid": "1b9621be-33e6-40c6-8d64-29602f0690c4", "comment": "Malware payload", "value": "1ef551bbfbc31d64fb1cf40242c5f832d9ac949b9f2da2ad8c6b04a0b2e617b2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217459, "uuid": "5eeef525-c269-4201-9d03-9e51f8fb49ef", "comment": "Malware payload", "value": "8c452677a1639cf2375519e423e5ba7e03d569fe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217459, "uuid": "4fce1502-f5d2-45ee-b30c-7d5da3716f3a", "comment": "Malware payload", "value": "2ed07f6192e534c50157c6d1012e5c314a235288268d769b5b3fcaa51383f165baf91db17b3232bbc9bb8e4622f931d1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217459, "uuid": "d8405955-f38d-416f-aeb9-bbfb2ffd4a6a", "value": "T16A236D651A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217459, "uuid": "0999440a-9661-4819-9369-81f484fd4bdc", "value": "768:4XRWNGxV49GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:slxXcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785217459, "uuid": "7841b7d9-fa9a-4b12-a2ed-bab5e3e05f2c", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785217459, "uuid": "2db248ca-59a8-451e-871a-b518b0ed073f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217459, "uuid": "8d76398f-0a76-4d46-b48d-f760c33c460e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c3957e-8a5b-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785225927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785225927, "uuid": "213513d2-7423-4e5f-ad6e-64ac46fcd1f6", "comment": "Malware payload (PureLogsStealer)", "value": "a9c85c1ff314cca8b7f2f44e6bab97e8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785225927, "uuid": "fd2d144c-47b2-4290-b4d9-dc2091dfcae9", "comment": "Malware payload (PureLogsStealer)", "value": "1f01e3b931247bcd13f8b1733b472ccb3eed66b0892c230c45eea2c28a2c5cf1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785225927, "uuid": "c45f04a1-ac26-4e16-ad5a-e46a282058aa", "comment": "Malware payload (PureLogsStealer)", "value": "e04d0c66dc5a749d4e801a070187ab931b2e528d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785225927, "uuid": "7052df48-e1a3-4e0b-85f6-6cb6532400fd", "comment": "Malware payload (PureLogsStealer)", "value": "50424ffdc1995b27ddb12f75f9c5ae97d15eb749dbfa0c4f5b9f43b22fe7eb09023cb06171c6302233321cc84c87f07e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785225927, "uuid": "2f25d485-f0d1-4b1e-8dbf-2ef1295dff0e", "value": "T1AC55A97DCC28823AC6B7C61DCECB4A07F99A1827321DFD4AA4D3735B9123153B4A616D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785225927, "uuid": "5f42e2ce-4600-42e7-813e-3244c6c6dda2", "value": "3072:6q2FgT0DNdvWECfKDi1e5P0QLIVnu4NQMu7RpVJkpGL7kSvc60rMrrFlHrU690Fo:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785225927, "uuid": "f418f8bb-d760-4bd4-a34f-e14192dbc348", "value": 1282328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785225927, "uuid": "3d7ded2c-2f0f-4dfb-9501-066292a74cb2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785225927, "uuid": "be6e0f07-b486-46a4-9136-77962fce2d38", "value": "output_t9xn2bvd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b17b84-8a96-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785251336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251336, "uuid": "25293fe9-af97-4411-8dc4-dd3255edf99e", "comment": "Malware payload (Mirai)", "value": "1a2f7711c016e09157e9594f5a7066ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251336, "uuid": "42b28879-afc6-43f6-b4b4-b93f1b1e8028", "comment": "Malware payload (Mirai)", "value": "1f54151c99a8a2c8abf0f8271bfebbb5faf60e477f431c8a668fc9f2640045d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251336, "uuid": "68c7cd84-6869-45ac-972f-47007bb4fda8", "comment": "Malware payload (Mirai)", "value": "33a45482e2d6d8ea0411ddba49529e304a6fb5d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251336, "uuid": "f1724831-bc1c-4241-bc6e-d319be106c1d", "comment": "Malware payload (Mirai)", "value": "7578d6c1ddef27f777c37cfef3a3b5116fabcb488c59871a2379c766e8765de2739a64b6b1dd35a3c27e9262adcd6064", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251336, "uuid": "210671ad-4eb1-4288-9b8b-db17b57974d4", "value": "T12BF33B06B30D0943E2672EF43B3B27D1D3DF9A8121E4E744295FAE4991B2D32558ADCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251336, "uuid": "041b2517-c58e-4cfb-8e90-74ee26d41585", "value": "1536:0Md3005xU/LKpb0Nx8H8X/yRec9oqS7eYBu9vbscN4DFKtbJ/sg64vA1PvpvLVjm:0MpPsTiAxbX/J034DFkJ6NZQeZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785251336, "uuid": "e5fbe213-377b-4534-801a-77792bb40742", "value": 158636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785251336, "uuid": "2efdfb47-bb2a-4d8c-b867-48c381f874cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251336, "uuid": "d0783345-8682-4917-a331-86ca249e0d28", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a602a2b9-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221011, "uuid": "67ebd75d-6ab9-4972-ac05-a910817b08b3", "comment": "Malware payload", "value": "70d9dddce374973f88370262b38da172", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221011, "uuid": "b8905f84-7dea-447c-a019-c89edafdd7dd", "comment": "Malware payload", "value": "206e8b0c4ce583ea5bed134605f1fe9b4b7539d913260939b55d28d209f80408", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221011, "uuid": "e2c794c5-7fe7-4ad4-aefe-f947b63c903f", "comment": "Malware payload", "value": "a4e7c73d885bcbca3f1cbd8517bf188795037b8c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221011, "uuid": "9dc104af-4ea0-4cd4-90dd-c4134dc0b7c9", "comment": "Malware payload", "value": "005bfe49ec772417641a0d151780d8e12af962022164bf72f6fc66343ce693d99e639b7bf88ccf1e3962c6db77afad44", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221011, "uuid": "5aff660c-71a1-4bcd-a473-b7e0d0c60f68", "value": "T11241E92994A58427EE63D57929E236E9519FDBB027FA3078FF480169D82DF3903190E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221011, "uuid": "ee06447c-577f-4766-ab6e-a368b6ecf61a", "value": "48:9laz1khMRLkNFlFX2euzcfeY0B+U2U/iQal5LFKc+bn7SW:Haz1k2qnf/rU2DpLFD+6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221011, "uuid": "16bffe49-7086-40ef-aa48-1ded827f8ddd", "value": 2176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221011, "uuid": "01d5cdf9-15ad-4867-9b52-95735b9879bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221011, "uuid": "aa940be2-df3b-4024-a66a-0917471b1935", "value": "images_20260727_075602.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352bcf90-8a44-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785216097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216097, "uuid": "d7f98a42-cf33-441b-a253-954ce21d3042", "comment": "Malware payload (XWorm)", "value": "782610eee2fd04982a22b475d6d58cff", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216097, "uuid": "85486b20-7dcc-4f10-8e0f-2459c0ea3146", "comment": "Malware payload (XWorm)", "value": "20ffedc10d9a3c0e549be81c6e4f99de4c6f32ce68ed9226a000b9918e5757cb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216097, "uuid": "a25a1cee-5113-4979-956f-f96436b02a3d", "comment": "Malware payload (XWorm)", "value": "5d14a288fad212e350bbf243d5e04ad8c245785e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216097, "uuid": "f741ca3e-5041-4d5a-a8b6-7604c420251c", "comment": "Malware payload (XWorm)", "value": "5dcc6b3ac59dc8ee406ea8a7f3fb4b252f15d806ba74dfe643c89e649f5f64318881d099db4de36c7045cdc822ff8fd3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216097, "uuid": "f243b8a7-4f05-4b77-a0e5-83b98453740c", "value": "T1C8A58E7DA94F3042A7AD2F760F4EB132B6CC93B0D6421FFB2160036651C5D1F8A66DA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216097, "uuid": "5efc3e19-6ecd-414b-a1a1-80a8167dffd0", "value": "96:pAOkZmLpyx8yIA1WFCHSUjvqDaSCRkaRkdV5FU8C58G8Els8c8i9JF70l8Qd+4PW:pAOkclqxk89v4Uaaa6mBlQdVEFJQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785216097, "uuid": "90728e9e-ed17-4e82-b4c4-add6e028db7d", "value": 2169257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785216097, "uuid": "a2e38a61-34fd-4d89-8d15-ff74bc8a1667", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216097, "uuid": "cded8d67-b0ca-4ce5-a801-3c097bbb632d", "value": "Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8b5372-8a80-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785241858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785241858, "uuid": "37da17a7-020f-4808-a41d-1db33bb484b6", "comment": "Malware payload (Formbook)", "value": "068f9e6a4d89584f06079e7f2a3e6d88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785241858, "uuid": "172a4ec3-d72b-4c0c-8a30-c425f1cf5d13", "comment": "Malware payload (Formbook)", "value": "212d2635b3cc5af983f4a1b1fbeb8b8c37dab4d1f01db4d82848ef2b1c8c012d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785241858, "uuid": "0742acf3-1c4f-474e-b2f7-684e1e24186e", "comment": "Malware payload (Formbook)", "value": "58b3fefd1ad27013f2ca4ffce2b80e94bfab5cb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785241858, "uuid": "04433e95-deec-4e89-ba90-6bd9d6a94a94", "comment": "Malware payload (Formbook)", "value": "0c36fdbe64c6eb5dad9f26aadcc85a81c458dc7e2d48a611c4122c847be80f92c6d50d588372247138f12963d8183133", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785241858, "uuid": "b4d88acb-cce3-45cb-a0f8-2c9d28a856b0", "value": "T1DB1619884A6449B6D5ECD30CEA77E740734E310790A9EF5E326A4388B7D9D13638C9E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785241858, "uuid": "3b5ec3c6-8ad0-4df3-b45c-c99641b33ef4", "value": "98304:InA4pvyuQFBPA2fQ+tZovmvHiI/BlaXVH8i4cZt4ACBgjsHS:sA4pv7QFG2fQ+0viHiI/mXytY/Tsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785241858, "uuid": "b0283dfa-22ed-4bfb-b40c-b1e066076649", "value": 4037287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785241858, "uuid": "f3e9bfa7-7795-48a4-8d0c-6ff92c2e2323", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785241858, "uuid": "dfa219ae-cef7-4d74-91d1-e8fc765ba751", "value": "DHL Waybill No 005107085566P.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f1f4b7-8ad8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785279827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785279827, "uuid": "6a6f28e9-50ff-46ba-b3fe-570f0e14a848", "comment": "Malware payload", "value": "ca789369076efaafc596f836d928abdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zigcryptostealer", "colour": "#FB31FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785279827, "uuid": "e9a5e4da-24fa-41fb-a700-ba579a83c10b", "comment": "Malware payload", "value": "21bf44a654a0059f7bb974ffe6252db63e998d5f95937454d45da4d700267471", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zigcryptostealer", "colour": "#FB31FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785279827, "uuid": "fde03f33-db72-4629-a257-dd4d4b250112", "comment": "Malware payload", "value": "e6d3f4d33263f731a78b914227ee9d12422830e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zigcryptostealer", "colour": "#FB31FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785279827, "uuid": "b7b0a1a4-379a-4a13-ab8e-5d9ba21d2516", "comment": "Malware payload", "value": "36822fc7235e1464440879a3b41ff17ca4af4eded25cdda90071b275006c682d38f9ce74fd6d4309621f3466e8188585", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zigcryptostealer", "colour": "#FB31FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785279827, "uuid": "6db7be07-652b-4bc9-a6d1-64a2930e197e", "value": "T1BC06121DE38D52DCD223D134CBA69232E6B5B85A0761BDDF169AC2192FB39D01F3A311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785279827, "uuid": "d69eca86-3f38-4bee-993a-4dfe2c74dda2", "value": "d7a140ad86093e229082e6f8b7493b94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785279827, "uuid": "2f007667-c896-468d-b760-1aaf39115856", "value": "98304:wuQgRnUx/PdELDYwWCLK2ZCouvZ4NTLCmAI:wEiVmYtXUoAL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785279827, "uuid": "93df5f9d-1d4f-4512-8a24-0d7bf9942fe5", "value": 3890176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785279827, "uuid": "11d21ae3-26e1-4499-8d4b-a59c8e7c48ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785279827, "uuid": "2a8509b8-810b-457c-b3dd-d51081fcf21f", "value": "yea8hw1uN1NGD0za.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34708b0c-8a74-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785236712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236712, "uuid": "3c51a7aa-84a2-4f02-936c-c4e317527a9c", "comment": "Malware payload (PhantomStealer)", "value": "53bbe08ee6d8f62a18628169f3a743bb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236712, "uuid": "18042470-1401-4fa2-aa52-344debc9cf2e", "comment": "Malware payload (PhantomStealer)", "value": "231cf8667128133cbe160a250ec7ac720a39fe1ce9c8b4d93a640fa1584a85b8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236712, "uuid": "1c46d356-a7bb-4281-90d3-1734e238cd2d", "comment": "Malware payload (PhantomStealer)", "value": "7c094ac9a39f6be53daf7e9fcd285c04a0220771", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236712, "uuid": "9da7a3d7-b77e-48ca-88e7-d216af6f13e3", "comment": "Malware payload (PhantomStealer)", "value": "17c3f567bafc2d7a6bc811a29c2bb2dda25ebe1692ca8727be542b464a76fed4885292a9c0677ed6b151b0e3e4d1b8d2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236712, "uuid": "9aae5e27-492c-4ea6-b0bb-0898a9803967", "value": "T1F857B85A09E6C828FEF887C7212BAD66062E515395346DA3CDC6AFCF07BD638841534F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236712, "uuid": "9bb21ca6-9dc1-424a-a292-39d9d6888d26", "value": "1536:dAhWdw+5wwZVCVHw+swwZmwvY5w+0wwZdwjw+8wwZN9Kwaw+JwwZoFwow+lwwZoF:wzBJBxGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785236712, "uuid": "da5236c9-e222-41ce-9de5-3bbf1dca6aae", "value": 28777266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785236712, "uuid": "aacb92e6-8e90-409e-a676-8fabc790cd9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236712, "uuid": "2afdb15a-e3bd-4ddc-b301-8ae95c773915", "value": "FedEx404098578575858785.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd5023f-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785224437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224437, "uuid": "c4a53909-37bf-4872-b882-7171a2ffbbf0", "comment": "Malware payload", "value": "9e7181130f040e4f574c18828c89770c", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224437, "uuid": "dc5aa542-2968-4367-a426-aff6658fb370", "comment": "Malware payload", "value": "23c93ff3d3ae02c9310e23a019d72c334dd1222a48142f1be908b2414e914355", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224437, "uuid": "8511232f-299a-4c54-9f04-7b66e409dcb9", "comment": "Malware payload", "value": "42ecb0f7b2921a19718d0f2bab40af4a57c61f0d", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224437, "uuid": "f1472ccf-0f30-4ac0-992f-f76759845037", "comment": "Malware payload", "value": "08218eb8204e452ea40c7259079566ad8d0f6e71d04591495199f5f0264484bd36f78e5481162689070b475ee9693e3b", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224437, "uuid": "f5d46db7-34d6-4bc7-b1c6-9a3411002785", "value": "T152553334977434DBC0769368FC8E00385F75A52B4DE7964618A9AD108F2D83ADFB2B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224437, "uuid": "5570edb4-9f6f-413f-b59e-368a328df147", "value": "24576:Me9kt8x3IQ03OUW7cwSwzjK75YUF0hzUez8+co6iV328B5kqkVfmO:MeSQb0b8PzjK1n0hXcJiVmi5kmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224437, "uuid": "7a4ed321-7036-4b48-8ee3-fcdfe0856c8b", "value": 1318412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224437, "uuid": "204ef2cc-82ef-4c00-8428-6731abcca35f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224437, "uuid": "7eda2200-6cdb-4c04-8d20-db5aacc1e999", "value": "kswapd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2def4f17-8a81-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785242285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785242285, "uuid": "72627717-51c2-405e-bc99-1e6ee395f89f", "comment": "Malware payload", "value": "f25f8855832139dcf9d955f44af6ccd0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785242285, "uuid": "0e676557-4a3a-4395-b67c-a0eef1da01fa", "comment": "Malware payload", "value": "24320655384ab3e7b4b41a3c63aa757181b0360c8fb97e7c5eafcdb657b29800", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785242285, "uuid": "9bf271ee-3aa3-4a07-982d-e400cef4f5b8", "comment": "Malware payload", "value": "537cb482e56c13f67a0db528fd75ae8ce33e4bcf", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785242285, "uuid": "fc3870a0-aed5-46db-ba5d-c41acd4d1714", "comment": "Malware payload", "value": "14bd0f5205884c5c89ec2d9e7109fce80059a058e3a1fbf7183ec76734f43ab304276ba0ae7fcb11a64401e974648ecb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785242285, "uuid": "71a74a9b-2d3b-46a7-93f2-d04d3148cdcd", "value": "T11B8633C6BD89A371C08BC3724112B5BE31297FD1FDB6CD02F6EA75005A7392958B9386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785242285, "uuid": "56e9caae-57c5-4666-ad64-7dc4a7188598", "value": "196608:gAftmXQaZsqxv5apGlSXrbMeQcx0yE71pBEfkgokKqcFLlrV:gAVGsexFlS/zN01W+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785242285, "uuid": "3631e18e-db5f-47ba-855d-916f91d5b40f", "value": 8425472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785242285, "uuid": "26c6d223-45a5-4ee4-aef9-ee57bff0b022", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785242285, "uuid": "4267464d-b4bd-49f5-a447-a70f35b4e4b9", "value": "Install_28n022.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ceb0e4a-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785245665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245665, "uuid": "5db9111a-7f4d-4a86-b639-0b5713c89387", "comment": "Malware payload (PureLogsStealer)", "value": "e23c0c97b7dcc8f83261c18e88dd2511", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245665, "uuid": "4e849762-250a-4a79-83fb-298b0b2fe5c7", "comment": "Malware payload (PureLogsStealer)", "value": "247ccd7c34e6600d90b6e6d5dc82858fcf369da21d9a323db52a37ade981c62c", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245665, "uuid": "395dba71-0235-40d2-985f-2e6397353ef0", "comment": "Malware payload (PureLogsStealer)", "value": "c1528657f1d50e0627cda0c31026c09ec536c16f", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245665, "uuid": "d16c93f0-a9ec-47c2-8f09-de9cec7e23fb", "comment": "Malware payload (PureLogsStealer)", "value": "fab0bae46e362c734d5384df43c9f816bc3021e7ce415b7698415c247837a315242b3a952d2cf86f38f235e55b9e729f", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245665, "uuid": "1313c59f-b3d6-421d-9c72-6f54bbcf4db1", "value": "T1E216AE45F7D80BD4E46FD630C96B8732D6B2BC960F62838F1554CB062D73AA19F6B212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245665, "uuid": "59351c8c-25a6-4e2b-a1c1-25a381266e24", "value": "f469ac0906218570f79c54d1b58dc057", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245665, "uuid": "f66b01f6-e36b-4f1d-bbc9-245701de3629", "value": "49152:J4AnDOnL3VSpJC/iu0cehTvgFKLGdswaJdgEUsbT/ukPjKNwCAhH5dcXOESp9r6:BMw2swaJGvs/mkbKiCA95dazSfr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245665, "uuid": "884c5ab4-0a23-4577-81c5-12d94b8f61bc", "value": 4028416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245665, "uuid": "472114b4-cfd7-4184-a680-046f57d0ab98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245665, "uuid": "77ee0e1f-0519-481d-9122-b1e564154a47", "value": "247ccd7c34e6600d90b6e6d5dc82858fcf369da21d9a323db52a37ade981c62c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c387608d-8a37-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785210753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785210753, "uuid": "88e7955d-143f-426a-862f-e7d5318096e7", "comment": "Malware payload (Efimer)", "value": "346807f0534467f59b6baea973ed71ef", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785210753, "uuid": "408e1b6e-3e68-4646-8ad9-9332efe782dc", "comment": "Malware payload (Efimer)", "value": "24ec774133cf8b8fd595751cffec810d6e179561644bc55e22301335aa6c028e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785210753, "uuid": "ff209189-48d4-41b7-af2d-f9199433aafd", "comment": "Malware payload (Efimer)", "value": "d07d8f5f0471465b0d9e78196a80b0be227d30a5", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785210753, "uuid": "57d06c67-0d7c-46b0-a699-454b0aeff8c2", "comment": "Malware payload (Efimer)", "value": "344ccad684731ea53a00ca5548f87f94fb8b616b0b2c37a637ecfcb6d8d5d259dcd4e31a4b3e4bd8d441e7d40f859af6", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785210753, "uuid": "5e3e4e6a-5b0e-4f23-9c27-b30ff8156205", "value": "T192E63304AAE022FEF573413DBFD0656CE599B8764B36C89B0B98C2659E232E04D3D753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785210753, "uuid": "45497125-c52b-4127-a150-86cac090c96f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785210753, "uuid": "839ef2e1-8d72-4b72-8bdc-0870feb40fe1", "value": "393216:Q8xRMVb9mcwtYMflGtVDT5ujXMCHWUjX9cuI3/PGTAI:QHVb9NwNiVvYXMb8XKH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785210753, "uuid": "014934b1-0102-472f-8da9-d62eca3fdb60", "value": 14330788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785210753, "uuid": "a93fcc99-d088-44ce-b287-ef4404a8c03b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785210753, "uuid": "7b5083c8-7a3a-477a-8070-2b187afc0c4a", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1536989b-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220768, "uuid": "e4f0a263-04b3-4f3e-b496-12de733ede76", "comment": "Malware payload", "value": "9710195cacf8185e4fd860c0537cee26", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220768, "uuid": "e6c3247a-007e-4475-bef1-25dde8a351cc", "comment": "Malware payload", "value": "25b266821994e7997254d7ccdb5ea30a311904c41ecde4b88938211b34400b48", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220768, "uuid": "900b3aa0-5bca-4e6a-a68b-a6a138e729b6", "comment": "Malware payload", "value": "b05bffa9013f8f81876ca3841720b9f6951921e3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220768, "uuid": "77666413-8702-41bf-9cb1-0cf2c5e0bd2f", "comment": "Malware payload", "value": "ed3a5ad1632913e99a118b7d0f6a6d80b89bd75e4ee9541992e77337633da956a5adfa99d711ec84fa90a452f5d23d62", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220768, "uuid": "2011b4bd-54f1-47a2-a791-89a1c721bc39", "value": "T1A342CFE9CC7C54A7ACE357356EA796AFF7E9B474DC72E50743888C58C10A022934D790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220768, "uuid": "6c617e22-8c2c-4d2e-9f54-ef881ee918b9", "value": "192:As5UtIQBDI6dKuVUXquBcBijdzqlMNr+Eh2Bp6fVplkJv0oZULnJr9fb:n6XVapciAlMNrr2BMdpl+8P1r9fb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220768, "uuid": "79cf5562-27e9-4ee9-8b19-e5214a8fbfc7", "value": 12463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220768, "uuid": "f6fe9681-774f-4365-9b89-0867dd73df34", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220768, "uuid": "bdb6debd-4181-491f-adf2-76d452da3ba3", "value": "images_20260727_165145.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea40c2a4-8a4e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220696, "uuid": "6346bab1-2bf0-427f-b629-63c3130b4334", "comment": "Malware payload", "value": "f3730db25999a3d002fd37066f561956", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220696, "uuid": "b38c8156-3173-43ff-9239-2dee029f896b", "comment": "Malware payload", "value": "270feb2e05071a737a7abcb5004cdccfba48736a244d1bb701c13747f24194d7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220696, "uuid": "e81d8b2e-7def-4e28-93e9-aa4858358eea", "comment": "Malware payload", "value": "59e17809a658cadbde55e5c730995def6d71e951", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220696, "uuid": "ee432bb6-066a-4aca-8633-f7aed73da647", "comment": "Malware payload", "value": "23cae8e61d268563f79ab49d3b7fd110378e9bfe103ba115600ef9e1acf08b6fae0e4ac1e34c3b4d01fc4c2fa0ac302f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220696, "uuid": "c9839ab1-4ec6-4bfd-9a56-3b9d5708aab5", "value": "T10D029E0B3E418B19FAAB73862BE84F1E3E28C57D0EA5B5D3378602C441D85D42D1B0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220696, "uuid": "a4ad7f96-663c-4ac4-b0eb-b15eb895257e", "value": "192:MKwEuqwh7xe/N9yoHleZxP4LDbXmwvZNRAZziJnGDx4s6SPzTyA/BurgQ:MKpuV7x2Nl4xQXb2wvWiZ436SPzTy/EQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220696, "uuid": "40e414b4-1268-40a0-ad4c-3d6534eb2ab4", "value": 8388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220696, "uuid": "6178fbc9-c3c0-4cb1-a193-aed7c3c0fca0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220696, "uuid": "163ad664-7f44-4750-bbbf-9d1ae1c35da9", "value": "images_20260727_122359.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0280c4d-8ad0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785276433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785276433, "uuid": "2ec1e164-b5c6-411c-8224-d857a82c376e", "comment": "Malware payload", "value": "0ef44458a9e859c23bad9df6bca69073", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785276433, "uuid": "d6cede70-d6ec-4319-a8a9-fa74b9133613", "comment": "Malware payload", "value": "27c74bd229840f70bb35cf28c00756d6fda16b0371789df00dd718c901041131", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785276433, "uuid": "a76caec4-74d7-492f-a02b-54be64a9fb35", "comment": "Malware payload", "value": "4182de78b83ea32b64e219842f60fb9b76275d94", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785276433, "uuid": "c12c11ab-ce91-49f6-aec0-ed0e46a014cc", "comment": "Malware payload", "value": "64f398180eaa8c6f10ca81f886b02e9df6de84ed8f419ba36ed735d26ee7b5605f886e378eb1516eb3f62801133a3bbf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785276433, "uuid": "2c2c426f-c238-45e7-b58a-e096632381e4", "value": "T1B9624C0AB4808035EBE144B4827F526644BDACB623C4F9CBF7E0648A5EB46E1F43216F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785276433, "uuid": "b73be0fd-401e-4f73-bff2-f198db8b0f75", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785276433, "uuid": "87cc0a22-d01d-480a-8585-c32a58582c1f", "value": "192:AW1sGnjXgjk8LMRI+4NJTMVJFeIFFBKUSfEzQ0XFd1gJxTmv8U9cth89ik:AgSMqcUlEHryav8U9cyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785276433, "uuid": "5f3f4d9a-1891-4a19-a1e9-f07bb742415d", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785276433, "uuid": "82a9caae-cde9-49d2-83e0-806ca5714d82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785276433, "uuid": "85de204e-29c3-4cbd-9572-b763dbb6aa9b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46782dc7-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220851, "uuid": "be693a8b-4793-4429-a02e-917fed292caf", "comment": "Malware payload", "value": "8101e5003cfd219c61f4827c396216f2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220851, "uuid": "6f8d653a-b45e-4f77-9db9-e6c877477a1e", "comment": "Malware payload", "value": "27d0914cea789775af6fe89affc638973b2d168d9e834a3d1b22ac5d30785627", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220851, "uuid": "6d04145d-1070-440a-b1b3-2fd6357ce714", "comment": "Malware payload", "value": "d5e57f4c036577b1101cc8e42475ae1d7610eb2d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220851, "uuid": "2879a47e-35fa-4c29-9305-69878e717578", "comment": "Malware payload", "value": "9c2ea15b8fe02401fabc52f1acbb030ac03329c8de6f8ca2439517302c187f7cd79657a4c2e305b85dd7c63a5f939c14", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220851, "uuid": "212032ce-9361-4d0f-81db-f79822359b9b", "value": "T1C1F19F2A483E5E2DF38BD839E5E37184C5C94346FBCB2932181244D54323A06A0E63EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220851, "uuid": "cac9c962-e3fd-4dd7-bff5-36c94671e7bb", "value": "192:za3nOb/y+XJzkkWeQ0N2E3HZr+Ys5t2+XePMu3M9+ac:zY8y+dkkSU1Ut9e3ELc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220851, "uuid": "762142c3-bc84-4990-89e4-43deb4b53007", "value": 7481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220851, "uuid": "9dcf350d-3525-4b89-a3f7-8f4a1af5094f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220851, "uuid": "005a4f84-f880-463b-854d-0e75db11372e", "value": "images_20260727_092807.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267045b5-8a51-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785221656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221656, "uuid": "c8bb2ef2-c98c-4d0d-82ed-4123f558fdc8", "comment": "Malware payload (Mirai)", "value": "ebecf66a8e92b4ea206c8ce7c6ba4c41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221656, "uuid": "05c025b2-df37-4d38-b4b9-2d89e458e6f4", "comment": "Malware payload (Mirai)", "value": "289234595091270a4435bb54b247e4fbcdaf4d39d046d7acdcd0a41be3da181c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221656, "uuid": "451a1b3f-149e-48bc-8a90-c21a90b8eb02", "comment": "Malware payload (Mirai)", "value": "5194744f8f6df228506b7d88c298b7c26a2ad696", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221656, "uuid": "6c6dfdef-3268-4e30-90b9-6f5c836af523", "comment": "Malware payload (Mirai)", "value": "8d79b9942d36247e3afc5fc4ea45827b814e9e780d5a318e4819a58688c68ee5453eb5d1b2d56fef8f8a443e5b027dc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221656, "uuid": "432c73cf-c0f7-4dc5-a71a-b3cc0fe9d3d2", "value": "T13DD46C6377218F64E361D27009F3C7A45BA521A20EE394CA937CC6207A5176D2D6FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221656, "uuid": "8851fffc-8d6f-4704-9b80-569a7a65b1a7", "value": "12288:CW+pNDTY01+hdMh075v4+GGF2FQ82gpjY+tKiU5e:N+rDEbyA4+GGF268ztcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221656, "uuid": "9b4a7d48-3153-407a-abfc-19236b012af8", "value": 598204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221656, "uuid": "84d2d897-3723-4cfe-9072-dd1ab21c3663", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221656, "uuid": "4d899649-0ed6-4dbb-8a7e-753018053177", "value": "real_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e874638-8a72-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785235951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785235951, "uuid": "92faee62-a164-405e-a1f7-399bc796682a", "comment": "Malware payload (Efimer)", "value": "e48199bb764bd840f0f9a6ae7f495a38", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785235951, "uuid": "8d19b61d-6761-4e77-be08-77eaea7063c4", "comment": "Malware payload (Efimer)", "value": "2a8e577f4a3e9d7930a9cecc839e1dbdc36570dd876ae54bd67d749535234f60", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785235951, "uuid": "f809ed42-48bc-4f5f-a059-0b704529c6a9", "comment": "Malware payload (Efimer)", "value": "f36a1a731debdbaec43b83fe4ec55485355cca0a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785235951, "uuid": "24341c87-f51d-48b7-b6a7-9ccc000cc06f", "comment": "Malware payload (Efimer)", "value": "f036ac9f534baefb98945280edd86e23532bdae728a92b6fb8ab503070c94e30062235ffcfee20a7a00129afc242f22f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785235951, "uuid": "eff5b9ff-abdf-4e03-a99f-c9c5817da71d", "value": "T152E63358E6E801EEE9724039BEA59264F531B8251B72CEEF13A4C791DE531E08C3C767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785235951, "uuid": "6cbd5e36-1c01-4991-be1c-0f3cfd5d7ceb", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785235951, "uuid": "f5c25e40-39a9-47a2-a3ea-8fb763322b85", "value": "393216:J5RTHoPchqvVmD02r02G6JHuXMCHWUjXIcuI3/PGTAI:J5RLosqoQ2w2GQuXMb8X9H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785235951, "uuid": "62af6e61-d458-413a-af9d-0f46498d5f5e", "value": 14264915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785235951, "uuid": "6999e38d-a56e-4ca2-a138-53810122e063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785235951, "uuid": "b7d22d38-5e80-4fd9-bd4a-e77e06cf9909", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa78946-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785245876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245876, "uuid": "f3ce2d3a-bb74-412a-ab0a-a451fd96e3dc", "comment": "Malware payload (PureLogsStealer)", "value": "e7d740b5623fc22528d3b813b4db0139", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245876, "uuid": "7bee7d98-ffc6-4b3f-8ff5-4cdf104c50be", "comment": "Malware payload (PureLogsStealer)", "value": "2b4975f71bb6e589bb6b1c23296b530ad798fedbdf392f58e69818d334a45273", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245876, "uuid": "d5a7f457-a15b-44c1-9b99-01bcc71a470b", "comment": "Malware payload (PureLogsStealer)", "value": "a7890c2ac513db571b751d0ad0d5386b7d714cd3", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245876, "uuid": "a3572e6a-fa2a-43cf-b5f1-4aeb70ad68c2", "comment": "Malware payload (PureLogsStealer)", "value": "45f475c6f7a08590bef60e47a94649764b1de325544347df468da262b894f8f80a4fb297e13eb57578b34115abceeafc", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245876, "uuid": "2d7d28de-0aa4-47ac-9399-f7086ed8c6f3", "value": "T13446BF16A3A901B9D57BD278C6968332D6B17C064331E6CB03E9D6692F37BD05B3B321", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245876, "uuid": "d512ff15-a115-4801-9105-1a727a30d218", "value": "49152:T9Xb1IAZ1nrfxifaT34KWiXZQRIvV1zMGPwT4P91Pae3p1F/Iiw9KpUmTfFqSgdB:Pl5LdZ4X4r26p/8lu5dZDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245876, "uuid": "33c8cfd2-d7cc-430b-b8e4-84b75531f7e2", "value": 5576704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245876, "uuid": "2c9860be-f249-4c6e-8ad4-9d24038b4544", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245876, "uuid": "14f30433-496b-45ba-81f1-f5873042a4a6", "value": "2b4975f71bb6e589bb6b1c23296b530ad798fedbdf392f58e69818d334a45273.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b0436d-8a21-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785201145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201145, "uuid": "d2ddb692-e696-40f1-a7ad-adf31acd7526", "comment": "Malware payload", "value": "0dd1faf40646a953c8cf3e2d9a43da7e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201145, "uuid": "b16c58ba-0358-4a35-aaa7-879274cddaf6", "comment": "Malware payload", "value": "2bd87fb7b4f22cf7685920959c4f335373be6f5aaa00668534f5cdc3bcd74302", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201145, "uuid": "64c1cc71-2a35-4aff-ad01-f833c91b7df1", "comment": "Malware payload", "value": "6fc915d989cbe98e89efa28cfffd07a7e7071e6b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201145, "uuid": "f9843a20-58f8-4d67-a118-301f0a47e2d2", "comment": "Malware payload", "value": "d4220eec6125fe4be9b2c37708ac5f12634b773a7652efc010b7b84b86d19483c1320846ca29cd6e26155af58171f090", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201145, "uuid": "8aab9f55-019d-4dbb-92c9-34ae21ad0e59", "value": "T1FD236C651A957C149E98C4361D7E2F0CB9AD43E6320852DE7FCB3CF28C8AA9DD20971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201145, "uuid": "0c388d7a-0af0-42ec-a3cc-48f29aa86202", "value": "768:dVEJVIhtMt9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:zEJ2Mucr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785201145, "uuid": "9c8d3eb6-0797-4a0f-ae47-bbe9a49c659a", "value": 50067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785201145, "uuid": "365259f8-4713-4d84-a53b-6d2c0b9cd8a7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201145, "uuid": "ddb38e05-8666-433b-b3cc-6f2fbf866bfb", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b12571-8a1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785200038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200038, "uuid": "cdd22c85-6a2c-4187-89e2-5ec5ec4c0a42", "comment": "Malware payload (RemcosRAT)", "value": "da64e24ade9227d1f7ce42063f8cdfde", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200038, "uuid": "f9fa27b9-c7d5-4ed3-9e70-833556b5df24", "comment": "Malware payload (RemcosRAT)", "value": "2c620e407eabb93dc16449499824074a38497caeb42abd7176a7d101a3bb62c2", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200038, "uuid": "9e914ead-998a-4a0a-9d80-9e1034a7c948", "comment": "Malware payload (RemcosRAT)", "value": "56a69a6ace082f5fe2f04d97aea953bdd7df3aca", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200038, "uuid": "6e95dab1-3422-415b-b8d3-b0e4cc10c570", "comment": "Malware payload (RemcosRAT)", "value": "c2a98a7b536a479296905872ff54fd356465ca9ce1c553ddcd2b67c0eb74e83f5afd074a4cf1e41031fc37ce55abfdcb", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200038, "uuid": "6ba0b914-2ba7-4bc2-aa8d-95a1f2ec1c76", "value": "T18C442720DCD40B3A0E5707EDFE514A65C9FDC5298626D0ACEADE071E50135ACEBBF268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200038, "uuid": "7f1b9409-309c-44d1-8aa7-809bce5ef76f", "value": "6144:Fup+vIhXYGB3WYMpumNpXqzheiGtYYmUR676YFT0:i6GB3WVXpkMd3Ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785200038, "uuid": "ccba1053-ecea-47f6-9eda-4b73f405848a", "value": 276196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785200038, "uuid": "7b1581c3-8a5e-4965-8000-8cf390673b54", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200038, "uuid": "5ce5b3c3-ae28-42e5-b435-6b9a8185f7fc", "value": "scan02_ Shipping documents.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa8bbb8-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220759, "uuid": "f947e950-fdb0-49d5-9b67-891367ee0b35", "comment": "Malware payload", "value": "5cf7ac254d28026e17f7ec0b2243ea5b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220759, "uuid": "ab10b98d-73e7-473f-86ea-4a4fbc27cfd5", "comment": "Malware payload", "value": "2c9dca68d06e270b1ce9c526df556804630eb1f263a4d32ee487e3d2f88d64e6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220759, "uuid": "54618ab9-81a6-4ca0-b68f-c0d872ec73df", "comment": "Malware payload", "value": "4d0863d50bc6810b9260e0a71767a26c6052198e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220759, "uuid": "5d7f2294-dd60-4091-8a07-5e40c9ed8383", "comment": "Malware payload", "value": "2accfe433580a5db43ea630f624bfdbfe949da2edb2760aa04e23af1bb20d6b609d696a5d4f998a34e2f8ac449710886", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220759, "uuid": "1550fda9-b645-42ba-a367-458b285f8988", "value": "T11A02AFA30B355063EF798ED141D9BF7BBD3E41E39823812DCDE7954016B9492EAB0218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220759, "uuid": "168b74c2-130f-42a3-ae87-9d110f014f9a", "value": "192:odniyYMqfYRGxkGrBmQDnb9uPC9CwtxZgVJiiD3FZn5ThKBD+hc:milDQIntp1uUnPIJjn206", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220759, "uuid": "434f08c4-949b-44f3-97c4-1c2c878494ed", "value": 8974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220759, "uuid": "fe7b86e8-9460-4d45-88bf-1deda1b2aa9d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220759, "uuid": "86225b19-f822-425d-9911-ec138781050c", "value": "images_20260727_130844.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7686f4-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220968, "uuid": "f2074409-fbe1-4f9b-9975-e42ca47f4e8c", "comment": "Malware payload", "value": "45d9ee015bf3c51e719e9a0ca27bc574", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220968, "uuid": "c41b38a1-9a75-4258-88b5-a060ee8d1385", "comment": "Malware payload", "value": "30060866a3841ca1b1cc51a8265339202b0b6b951bb89ff5f5483c7793adc01c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220968, "uuid": "24c5b23f-a12e-4de3-ae07-7c071a5cb572", "comment": "Malware payload", "value": "f8028e09d341e8fc92cc0f4002350d1d285f8b60", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220968, "uuid": "e21d271f-9fbe-438e-ab1a-4cac6c3d6660", "comment": "Malware payload", "value": "b7c7f4a561f83cdcccb1eb629beda61f868a3c0bbdff1b51c12c8eddc743237b88fef2cd85fc8f30b1693b5c4ad63007", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220968, "uuid": "95ae35f1-6930-4cf4-b583-ae64734767dd", "value": "T1CE715B3088240FDBDC3F50B424E37AA516C408FA932621AE66FF3039D768A5456DE25D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220968, "uuid": "0d24dda7-92c5-4a4f-ab9d-37af9673d985", "value": "96:0gL7asG5/9fM563qhGIg/6z0ftCHHVkb/2dQzRgH:FY5F05hhGlflMWzzmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220968, "uuid": "fcd71f7a-48e0-4620-8fbc-883f072f5ee1", "value": 3699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220968, "uuid": "7dfefcee-2ce1-4c0a-87d8-54ef3f468769", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220968, "uuid": "06438cab-cc22-4db9-bafb-ba11c7ced50b", "value": "images_20260728_022532.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f29769-8abb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785267179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785267179, "uuid": "21c2ace0-bb7b-4b64-9580-3b7c45fe0681", "comment": "Malware payload", "value": "28abf9601234e3e8a372878eafcf589e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785267179, "uuid": "523b2612-e119-4487-85ce-c33c6351a860", "comment": "Malware payload", "value": "309373483b37a15cf1f6372a918418681c4fbc549cc128429c672e8d837dbf88", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785267179, "uuid": "30574180-fa3a-4218-a752-503b5b0a654a", "comment": "Malware payload", "value": "2061168b948a71fe6b2f5f55621f4e27fd3e07dc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785267179, "uuid": "2d72270a-bd3e-464e-b8ed-d5fdc90fd3b3", "comment": "Malware payload", "value": "de37294655fa39512b6c232f72a4656fdfa0ab8b167fca576ec125f135a8d45d233e13ad1aa80b04279c09d04abc401c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785267179, "uuid": "0a63bf09-d3c7-47a6-bbac-b8b97c8e5d9c", "value": "T117668389EEF722419D4370394BAF1042F1B9AA0B544DDD40B90EE3705FB162925EEBF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785267179, "uuid": "d7ed7361-211a-470d-941a-27299a6c1773", "value": "49152:SdBawcWYI3hJhdOQ2t8X7xfN3jVR4E0oRADEWm:SdB0W3db0E0RDEWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785267179, "uuid": "d4b35ad3-101a-4ca4-a33f-86c25884cda8", "value": 6543743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785267179, "uuid": "c41d7214-41cd-4990-ba27-08cd7ea05d39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785267179, "uuid": "60ec80c0-a3f5-460c-8552-128c879884da", "value": "OTBank_Payment_28_07_2026_440802.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd086007-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785245961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245961, "uuid": "2cba18db-94bb-431b-b12f-39856918e15f", "comment": "Malware payload (Mirai)", "value": "a82af89ee03e67a7dd45c956b4e00e73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245961, "uuid": "96a95d3c-f23b-4426-8608-721efc629a68", "comment": "Malware payload (Mirai)", "value": "31d9bbc413029d5ead691de62c2c283b3da1b34759946c3535024c42387845f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245961, "uuid": "b97d1907-412d-4c2e-b9e3-5dea7eb43f49", "comment": "Malware payload (Mirai)", "value": "c8e4d2af3002b1fff6f6774f9680aab2bdda402e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245961, "uuid": "b7441e31-0a24-41ef-97cc-50262f4e73d4", "comment": "Malware payload (Mirai)", "value": "2b0dc6d3ed7720698f6896b96adc1741d2c839cb86c43c06e6d6db1de834e628fe1195695e31381c5ec4ffba53a40d1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245961, "uuid": "01bf5f56-fc6b-4eb1-a3bf-5f382d8c1942", "value": "T15F73186ABD419F15D4D526BAFF4E434A33136BBCE3EE7102EE145B2527CA91B0F2A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245961, "uuid": "f1833191-9baa-4799-b088-1c9df0f3a03c", "value": "1536:GenRo41TZ5pETBGfBC4zfvNWswARvDEVDPzXkA0WIdlB+i8WjiY7jxpc:do49BEdsvws1R7EVDPzXk2U8WjiCjxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245961, "uuid": "c9ea4bc5-2d66-48aa-9eee-55e95869c737", "value": 80336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245961, "uuid": "e047abb6-9ecc-43b3-8871-8c49ebc4fd0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245961, "uuid": "5d2325ee-ebcc-4ccf-aed7-2a672969abb5", "value": "EMu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148e8329-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233223, "uuid": "07a7c777-f8f7-442f-9190-9be45a3e3538", "comment": "Malware payload", "value": "9b5cc68a6fcb1b1374e11874b8ac3945", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233223, "uuid": "4bc06edc-87fe-46c1-a086-b78649b18976", "comment": "Malware payload", "value": "31e677766c870a52e01c14ed84bf98d59b9534d0cf265ffef8b40b9b4b245a5b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233223, "uuid": "bcb77e89-dd11-441a-8cea-692d6918dcf8", "comment": "Malware payload", "value": "156fae47d3b1bd91192fd29d00602bf95e1a8536", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233223, "uuid": "00b7d95e-53d7-4f43-b1e1-d7487d19dd29", "comment": "Malware payload", "value": "88a6c3ffc727ca2957ab55e08498bc6eb33eb452a39cb4fe2f0c2d89ce9176d27ad664918d220949b2ba91e676478df7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233223, "uuid": "abc70b1d-d4dd-4c0f-89a5-5baa4524ee25", "value": "T111D19E2090116A27DDF6B8F2B29785AB0B33E1359169131B7C0C818CD63967E3B6BF15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233223, "uuid": "e9c1045c-cd74-4a56-b503-54edb8109977", "value": "192:VT6/GcKUGFpcMJg8J16WvJ6GYlqFolIeU06hH:l6ecycMJJkWh1FolX2hH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233223, "uuid": "31935b54-1538-4ad7-9777-baf06615d3d4", "value": 6501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233223, "uuid": "a9819edf-5cf9-40cd-9985-43ceec113754", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233223, "uuid": "1a667d56-dd1a-4cbb-997a-14bf8ca17cf9", "value": "images_20260727_150239.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18fd008-8a9c-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785254182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785254182, "uuid": "df018944-c7f8-490f-aacf-4f74d926ccc5", "comment": "Malware payload (AgentTesla)", "value": "a9f96cd6cb928eb46786f7aeb9bfde84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785254182, "uuid": "9a93a09b-be84-4026-a56e-18dfb02e49c0", "comment": "Malware payload (AgentTesla)", "value": "3215c8a0e90f544920b86ffffbf03afe1773881b60c2c23f530519a4c96e49ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785254182, "uuid": "8ceec32a-3c49-4741-9995-59a6b42cd18c", "comment": "Malware payload (AgentTesla)", "value": "33b3b6899904295122915dcdbe9d101f12469f3d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785254182, "uuid": "33c39ac2-e640-401a-8597-b168015e3183", "comment": "Malware payload (AgentTesla)", "value": "c8d6bb947f0380b799f65625f9aaad8fde50f6c7319068e377da47c6a4928689da359634675812e466fc364bd38b8b6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785254182, "uuid": "6f5bf0de-6400-4cf1-a990-0fcfb879df60", "value": "T187957ABB99C9E485CFB4729D487950EA68A2F84E3C8B328D7ACC934104B155D811BF7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785254182, "uuid": "fd56c616-9e1d-49dc-90b2-f278e43dac55", "value": "192:GGDGDGDGDGDGDGDGDGDGDGDGDGDGDGDGDGDGDGDGDGDGDGDGDGDGDGDGDGDGDGDt:OtV+VI7Z2WwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785254182, "uuid": "f6ce21e3-e2be-49c8-b723-58bd18f9ffeb", "value": 1985926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785254182, "uuid": "60133afe-2721-4ac4-b755-0f93b6a143c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785254182, "uuid": "369a48e3-c7d3-40e6-91a6-c7ecc07b1ee8", "value": "producto.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "357a8622-8a8e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785247881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785247881, "uuid": "a2a5da4b-376e-4076-b10e-7baff9662a20", "comment": "Malware payload", "value": "1a7ead68c72036bb94fa3aeebbd62fce", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785247881, "uuid": "7223a718-d29d-4c41-add1-d2309d18a69a", "comment": "Malware payload", "value": "32600c81eefc482e16f3622b689c5dbe160d069b88c2d2eebaaece06f53315d5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785247881, "uuid": "f52989cf-2f87-47be-8a3d-a1a4b0419015", "comment": "Malware payload", "value": "434fbfcd15923fa19abe584aa90f2919a480d862", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785247881, "uuid": "4545f93d-12d6-414a-bd81-1ae9b61f7819", "comment": "Malware payload", "value": "d8acbd201e20e33d79dee1c828d1f8fe05be0df9f84526c945f0b4d8df71a0b948f02b211636c98aaea480b024e066f5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785247881, "uuid": "53131fd4-92e6-4b5d-b807-1a97624e5be7", "value": "T1FA236C6516857C14AE99C4375C7F2F0CBDAD43E6314492EE7FCA3CF28C4A6AD920861D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785247881, "uuid": "87c7fe6e-cdc7-4175-a3fe-2d7343a32ad0", "value": "768:fr9NyXsZztCn9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:jHusZxcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785247881, "uuid": "58a06d5f-c9d1-4840-8a7d-3e500db6ba57", "value": 50035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785247881, "uuid": "c7bf220f-e4ea-4440-aa59-3719e9f43f01", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785247881, "uuid": "830d0238-328b-4e8e-8cba-7053d1c0a1c6", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb0a351-8a6a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785232350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785232350, "uuid": "e359d694-14e6-4311-ab00-b9c008f1d95b", "comment": "Malware payload (Efimer)", "value": "1ca303227696443d914fb59cd63aa52e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785232350, "uuid": "0b3fa761-3ab6-4758-be92-fb6cc1eab422", "comment": "Malware payload (Efimer)", "value": "329519abb208137bb0ed2129efd51bd1cd85b1a21610c33aef2d15d7379cfca5", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785232350, "uuid": "0e94187b-eae2-452e-aeec-6b2436863f93", "comment": "Malware payload (Efimer)", "value": "65e2c71e1d9330e57086efeda08729f5906acbb5", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785232350, "uuid": "a46b93fd-2bd7-4dfe-8c80-ace4c64364b2", "comment": "Malware payload (Efimer)", "value": "31aa56c30d3a7cafe865190306ff0110154b3641d29380545171f91ab322c6221545db5f1cba8f3940bc73ea3f235883", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785232350, "uuid": "1f833fb4-2862-4b0b-a011-428a5b25319e", "value": "T1D6E6331899D101EFF6E7803CCDE1889AA9A874771F36CBDB67A453729D670E08C39253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785232350, "uuid": "9d792200-1b7d-468c-a6c7-7216d223084b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785232350, "uuid": "8dfd0221-ace6-42be-8e0d-60492c91f273", "value": "393216:3p/Eb83WoKBiMVEg7r+dI5XMCHWUjXqcuI3/PGTAI:3FRmRBieEgH+dWXMb8XHH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785232350, "uuid": "245c261c-721c-49ba-8a0f-573b2832c1b3", "value": 14285440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785232350, "uuid": "1206529d-154c-4733-a892-3a1e73fb58f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785232350, "uuid": "4a94e924-b86f-4336-b40d-1aacb5f7963f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f853cf9-8ac6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785271949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271949, "uuid": "e835e32e-01f5-410a-b36e-81ba0e0b1158", "comment": "Malware payload", "value": "416574c8aa11daaf9c463308b444a21f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271949, "uuid": "5a985e01-8d14-423b-a69b-a03764e69a06", "comment": "Malware payload", "value": "33180419d2e3b1763ef0e67e1a98d9964c16efa97ea164242d098d8d1eaf172a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271949, "uuid": "ebc6603f-8889-4f43-b80f-570245b0ed62", "comment": "Malware payload", "value": "3ff5ca5530132c7747ecf9a3e7d7873da0cf2e3c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271949, "uuid": "2172a902-ab5a-4482-a4c2-9cc99b49eb64", "comment": "Malware payload", "value": "a692c8de616d92efba40ccc080755259cec6a117209d1956e8351a8c1c375504b1a184fcbd6a3d645744a4309f9cc524", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271949, "uuid": "b8a5c68d-8c3a-4215-8b37-75f38d95d6fc", "value": "T12CE6331896D012FDE5B3213CAEE281AAE5B874B51772CADF47D893A16E271E04C3D743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271949, "uuid": "0ca3574d-5b5b-4b8e-b480-e793b6624c18", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271949, "uuid": "fe3f9b08-07a1-4c77-a691-4b75f0d24eb6", "value": "393216:On+M8ULqWXwZjpGkjd1aS1NSVs7TOfEXMCHWUjXfcuI3/PGTAI:SCWXmGkjjXHHUEXMb8X0H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785271949, "uuid": "9bb23fbe-8e12-486d-9e3d-2a7b48858850", "value": 14259654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785271949, "uuid": "f9deb5df-3599-401e-b6dc-f31a516f45fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271949, "uuid": "6312594e-1bc2-4e8e-8c0c-cba30ddac3cb", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38400f0-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785211155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211155, "uuid": "cd7cd502-4e4c-47ba-b814-710612363394", "comment": "Malware payload (Mirai)", "value": "94b508ec3283037b88e1ff02647720a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211155, "uuid": "9e2b15bc-f97f-42d1-ab42-de570af5349e", "comment": "Malware payload (Mirai)", "value": "33646d861df1394a138b22f1f7a9d84bc0bcbf83b44f18edef8ff85aef77b45d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211155, "uuid": "447184c3-dba8-4230-9cc0-bdada58c5b75", "comment": "Malware payload (Mirai)", "value": "525426d3cadba71126f44346f7a910442160b8de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211155, "uuid": "43778ac3-f472-4710-be2c-eb0334654000", "comment": "Malware payload (Mirai)", "value": "834e6023217a98e5d2db2b04159bca4b435ef92b795efbd8b9a45707e5700b4050a7f8ba6718ba82804f4b736d3a25ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211155, "uuid": "47b258f5-76d3-4414-afb0-13c38284190e", "value": "T1F31423A557700420CC9E467B742D40E5BFAFBE10129FDF1C7F0A4D28116AB5B68E8B6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211155, "uuid": "32ff0355-2d62-4461-9b51-281832c1c684", "value": "3072:h8PWBF+BhRV9H+J3wXDoX91F4yU90IOuoYaqqc042DLyZCvbXg3xtHRhjwLXf1EJ:hwW3EhL9HO/3F5q33aBcn6GUvDg3rHRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211155, "uuid": "19dfaf18-9bd7-4524-9bb5-51150dd0a2dc", "value": 190872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211155, "uuid": "8daea1bb-2d75-4b6e-891b-5a73485a35b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211155, "uuid": "14863459-13c6-429d-a950-c8f601368f63", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19de3ce5-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233232, "uuid": "29d7f7a1-0d9e-4448-a16f-b674b7d6a2d0", "comment": "Malware payload", "value": "fef729febbc31a14b759eaded3e08c6e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233232, "uuid": "224893a5-ec5a-4665-a8ab-56f966fc0b98", "comment": "Malware payload", "value": "33a3959a846fd4563b7225b740dd5080863e7c90fb6ee6ddac8deb23bac867d9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233232, "uuid": "c76ab3bf-c801-4c07-b396-dfb86855dab4", "comment": "Malware payload", "value": "59436823ed4005fbd79b6e98b48ac6213285c9ba", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233232, "uuid": "03bfa1ff-1972-4143-a5a1-1808ab3940a3", "comment": "Malware payload", "value": "460a0d55ff34b18c6d7a5647d5b7e4a40ad52d0e45ea3dba56431d79902671c6cdf451b05b57f83d834e632ffb1fedbc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233232, "uuid": "0557c786-caee-4b68-9674-358d346fb1b3", "value": "T192815CCCE4490611F0E8ED752DCD1B6CA14999923AF3033355BB5BECE9216A48F2B0E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233232, "uuid": "af13e4bc-04f7-419e-8f0b-2e4216e98b9b", "value": "96:mx7i7qu3QvzrxfdCUJ6HvjPxknuVJCWEg/E5LJ6U:OvzNFCW6HvjxGwotKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233232, "uuid": "a98c7652-e3b9-457a-90d1-1911869994f7", "value": 3976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233232, "uuid": "b9f068c6-1542-4b68-9b8c-d881a84f253d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233232, "uuid": "ce1bb886-2093-4715-976c-5519c29f5370", "value": "images_20260727_161151.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5d82f8-8ac2-11f1-bd95-42010a9c0009", "comment": "Malware payload (PythonStealer)", "timestamp": 1785270307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270307, "uuid": "e02ed641-b940-424f-b943-5859b0b5ea0d", "comment": "Malware payload (PythonStealer)", "value": "cd4e18657cb4ccf267b1c2f5a7b548aa", "object_relation": "md5", "Tag": [ { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270307, "uuid": "16529203-ceeb-4bbc-863b-903b6d319b24", "comment": "Malware payload (PythonStealer)", "value": "350e280370d76945e1b4d460009d97d6976fcc4e33c966d73c78d4b520b50874", "object_relation": "sha256", "Tag": [ { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270307, "uuid": "c17ee96c-6222-4854-b1d6-ce967237c476", "comment": "Malware payload (PythonStealer)", "value": "86cfdf3f47b77909ad4288ba2176e066a86982ef", "object_relation": "sha1", "Tag": [ { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270307, "uuid": "0efa1123-9212-448e-a56d-d6438b24ef39", "comment": "Malware payload (PythonStealer)", "value": "1cedc6ccb034a2daf66b6bf85b8ece98e2ec932078a42e41f4bdb65a77ac6ef01b927a35bda55e33f2acb42caaafb619", "object_relation": "sha3-384", "Tag": [ { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270307, "uuid": "97cfe30c-02af-4d3d-920a-b677480ff87f", "value": "T1D096336B692179C641CFBB715C206F425BB921B11CBF854A3D9FCA27EB080BD78297D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270307, "uuid": "d2716029-c52a-44d6-98d1-3355d18e42dd", "value": "196608:qP/2RiSqhv9KDyT1VRZU+CktN9iBtAB/oB76qZXW6znj:y+0SmWQ5ZUqOBgOdXtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785270307, "uuid": "61e7184a-163f-4d62-836d-52710e388ca0", "value": 9047167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785270307, "uuid": "5bb6ceae-44eb-4319-b587-e75f7625b0fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270307, "uuid": "1c921117-ef8d-4d4d-883e-ad075b1560fb", "value": "New_Specification_Of_Industrial_Power_Generator_and_Quantities_Needed_For_Each.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59fefb8d-8a74-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785236775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236775, "uuid": "70327273-772c-41b0-9052-4447c768cee2", "comment": "Malware payload", "value": "c675cf33b489f681556814fc8fb1238d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236775, "uuid": "cfa977a3-4002-43f1-942e-fd41cf6503d5", "comment": "Malware payload", "value": "357950ccfc6bb1b0bff5c2bbaded55513fb5ada82fe91bb9a1c11c9dc68a4d1a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236775, "uuid": "1926c12f-d55a-4d88-99d6-40516f046a32", "comment": "Malware payload", "value": "c0259d3b76e584eeed2ba9dbe32c51ea945e4fcf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236775, "uuid": "afd1e630-374a-48a6-a25d-7accc7cd68dc", "comment": "Malware payload", "value": "9fea9d0f67b1facbd6f2dbc6fa82553d3d8f9b32a2db91c2f5699eace0fec73d44391eb0ade160ed0f8eb435a0427e3e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236775, "uuid": "a78ae423-82f5-460d-9a5a-0080f2e491e3", "value": "T187514FC2B5A53C383CB798A7637A2814318550216EF45FE9E5D8FBB4598FD2122843EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236775, "uuid": "3132b8fc-1118-4815-8f37-48727069eb27", "value": "48:D7Ty7N7+t6fkzU9Kv0yot7z7o7tQ3oO9uvch0Gyp6VSnp+jofgQ3o9KZ:D7e7N7+t6fkzU9Kvzot7z7o7tQ3oO9uL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785236775, "uuid": "d7bcf0ae-8922-402b-9a01-a4f177e7a33c", "value": 2677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785236775, "uuid": "2c7d33e7-9d84-4747-8ddc-496e11df0068", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236775, "uuid": "03389200-9ea7-4489-aa91-173ac6613ad9", "value": "357950ccfc6bb1b0bff5c2bbaded55513fb5ada82fe91bb9a1c11c9dc68a4d1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4080255d-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220841, "uuid": "66ac5a17-b6d3-4b65-84c3-0f7d95ec0079", "comment": "Malware payload", "value": "0cd9d5f8c92a1dbf65217a100808c714", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220841, "uuid": "f9024e83-bb4f-4ffc-a71d-d902b6f0acce", "comment": "Malware payload", "value": "35b131fca9228be32b18b674056af8b8138cd4b98a289421c85e76f62e95e043", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220841, "uuid": "3dc37fe8-5b04-4c3e-be92-8eac931e8475", "comment": "Malware payload", "value": "60e299a8bd5ac88416c98e5d69a5e58c6b4222c7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220841, "uuid": "00061d6a-1481-4ffc-95eb-4e2cce0ffa7b", "comment": "Malware payload", "value": "b5e1d55031d347f22c6b9936c8a51c2679318095edfd97227ee7cfbdc7192dbcb1aeb3252e75f6fcaf88d5e75c7c0f1c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220841, "uuid": "d4b1e0ae-28c7-4969-862c-f39cb6c1df41", "value": "T11F12BEBA94389154C9F4BAB692D1B9FB556D2331324E2DCF30500B4A648E3CE96AF02C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220841, "uuid": "c218d1ea-3adb-475b-8dbc-663a54f2ee53", "value": "192:CAbEYw5fFrBLd2hvZmewDUOkoUO9vZKxOzBs+4wQL:v4FTdwBmhDuoF7c64ZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220841, "uuid": "4bbcb98e-0606-4a71-bb39-166d2e19d481", "value": 9707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220841, "uuid": "c59025d5-75b6-49a6-a0bc-dcbabf70efc2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220841, "uuid": "b89d967f-b9bf-4a45-9201-541d05d27262", "value": "images_20260727_151104.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04dee4a4-8a50-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221170, "uuid": "cd6d5ad8-e2f1-4e34-804e-9a32b00bd5d4", "comment": "Malware payload", "value": "b792fbbcbfba9624d8529088fe6473ec", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221170, "uuid": "3cd3ed6a-788d-43b7-8839-5df7c345042c", "comment": "Malware payload", "value": "36032d880dccb83a4c20a88f08b6da73da33b9ffde996628b32e56c8cbf7c960", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221170, "uuid": "a51ef25c-d144-4ab0-9a6f-4bbdbf3892d9", "comment": "Malware payload", "value": "533bc7f522df2d6458c6f6b5a93c04b69db40e86", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221170, "uuid": "bdfacaeb-1e4a-430f-99d8-85baee388090", "comment": "Malware payload", "value": "de367f7e21de3cf7ea517e2dbe1a6c003f4eb136a7148678d84dc884dbfa26ac406d23b1aa2e8c8d094ff40ccd78e8fc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221170, "uuid": "4773f817-6461-4000-932b-9af077dff814", "value": "T14952CF1DD4FAA7D35E4A0FB110D2DBFC4D769F15DCDA202552AE001D38A6C20CAB12A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221170, "uuid": "f2c21a26-f88f-43f2-87ad-c622bd5bec68", "value": "384:PfXqU8BQtOeG8Fk5qvccFaHG/oO9G0WBi+1y:Pf8leWQvcOwlssBi+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221170, "uuid": "0d76677f-5c81-42ca-ac9d-233ac09d0979", "value": 13752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221170, "uuid": "e134eecd-63d0-4657-b3f8-eb9e6879dc19", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221170, "uuid": "2b0e2cfb-4066-4aac-89f2-fa86433c4a1a", "value": "images_20260727_214700.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1bb5bf8-8ace-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785275550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785275550, "uuid": "aaa3645f-f3ed-4af6-944e-78d587d9ce98", "comment": "Malware payload", "value": "1d7dcb19327ba5cd1893d4469f3c8d56", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785275550, "uuid": "89759c80-cf1c-4cb1-ad11-cc975dad101e", "comment": "Malware payload", "value": "362d59aeb45ccaa8f46889a6760d9fdd4bf1a1849548483a4ed164d232458868", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785275550, "uuid": "0a402c1f-6e66-49c8-93d9-a5e5c8eab653", "comment": "Malware payload", "value": "0d5ca6501cd3d83943bd80bf6c70112e75d456cd", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785275550, "uuid": "d8d8b286-9750-4526-bfa1-04e13b6d5170", "comment": "Malware payload", "value": "ccb1fa9f53d6ecb5acd101f7081394a40b1f5ced6729ebb926cd14bf167b789c1b27579e538c35526793c73cd2fe57ec", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785275550, "uuid": "5d1edd95-25f6-4fdb-8e8a-c42dff4b625d", "value": "T1DBE63304E5D151EDDAF3113DBCE19A96D26978B11B32CACF4BB862B22D171D08C7EA43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785275550, "uuid": "5c8f43b2-b719-45b6-b465-c2bda9ec0312", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785275550, "uuid": "82cdbfd5-b9a4-494c-bdc6-05cd230133c8", "value": "393216:2g1+ML7gSQJp6bxPTyHcGXMCHWUjXKcuI3/PGTAI:2goM8UPTy8GXMb8XnH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785275550, "uuid": "00271611-b419-4883-b805-09c2202d5de2", "value": 14241789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785275550, "uuid": "70b828b5-9db0-428c-a050-8b1253bc66ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785275550, "uuid": "647a2bb8-5682-4f0b-b5aa-b634efef8c9c", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4232a923-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233299, "uuid": "1f10ead0-f845-4479-bfe9-1bc06009c42b", "comment": "Malware payload", "value": "da685692380a6b3dad53fee5f9b59901", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233299, "uuid": "3e4d73d2-e964-4ce1-9b7a-9de3283933e0", "comment": "Malware payload", "value": "3722fac34b311c24130c264964c8ab77e2ce641f824a8b721c8d9729ead2386a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233299, "uuid": "b5045a96-ce62-4bce-ab69-9db1be221a44", "comment": "Malware payload", "value": "ebf132bbdc64f4947c09a69e640591864d0299bd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233299, "uuid": "e630c151-a5c2-4d48-81b2-5757ec2de1f1", "comment": "Malware payload", "value": "91927e9f77cd66864d67029b1ccd0b27b9843efc1b56d6f6a880e5a4daff3bb51bae7c03458ce9b8c56c78e10c2bf033", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233299, "uuid": "5064b6e4-27b9-4b51-86b3-663b88c9f344", "value": "T1ECB18F8298B6CA53F7F70A231B954C56A75CC3837859505BB02CAC1A1DAF69710EB130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233299, "uuid": "1283492a-5e28-4ea2-a242-5644728a77f1", "value": "96:LiyNuWxsQL+ayOrimYrUBJyN1KfJHWQ9lj6wIEAMOCzCqsrXy4175ggLmQ4c:LbfxJJZnYrUBJyN1KZW8c5MOCmqmyQmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233299, "uuid": "776bba7a-14a9-4f5c-a1fe-4e7ade36fe43", "value": 5208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233299, "uuid": "2298fd39-a4f2-4337-920f-b91fa6478f48", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233299, "uuid": "4d750749-0c1d-428b-917a-abdfd026c56d", "value": "images_20260727_181358.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2a5cd5-8a9e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785255029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255029, "uuid": "1b41436f-a23f-4b8d-b178-1dfcd86a00b1", "comment": "Malware payload", "value": "d835118a9c1f24a92b2f66c9265075b1", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255029, "uuid": "1a77f090-45d9-4a46-8bba-ef58d8bed31c", "comment": "Malware payload", "value": "372fa1524bcf4bb658b87d830071be38826beafb3311cd73c3d0314433233a5c", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255029, "uuid": "b77f42e9-047d-4166-ad35-15460fdefb3c", "comment": "Malware payload", "value": "fd73c3f745cac1102974376a7fa85bfa07591c7e", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255029, "uuid": "ed63336c-aa04-4a12-960e-87ee6d139f9e", "comment": "Malware payload", "value": "956e634561813e2139bfe456822d974541a521046440ad217cef4ba6870d344a90002de71dd96cf20498ce232c9db3ba", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785255029, "uuid": "fbad4fc8-27e5-4dba-b05f-a66cecbac7c1", "value": "T108121D36FA1F691C900B38A681009B91E433404F334CEED2BDB5BBF79BA5528992D55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785255029, "uuid": "0fc359e9-85d1-492d-aa5a-76c92137c1bd", "value": "192:S3LNPKcjfV4z+/JomoQRQD9eb+0XjC8Jxu6W7O+VYHlUlbCNefXW7cHlUlbdoeia:S3L1fvRcQRQD9e3LpefYoMFCKjBa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785255029, "uuid": "72b4bbec-580f-4256-a1f3-1aad23dfdc4c", "value": 9785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785255029, "uuid": "112bfcae-1259-4545-bc9d-6bda0a4131b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785255029, "uuid": "5b3f1299-791b-4d35-b87a-e96a8127500f", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b827991-8ab0-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785262521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785262521, "uuid": "05d0d2f0-a9cb-4f3c-bf61-d3bf5e2dd820", "comment": "Malware payload (WannaCry)", "value": "d017feba12f5960520155ba240beb093", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785262521, "uuid": "5548d534-7d8f-4daf-b96d-d0a347d07849", "comment": "Malware payload (WannaCry)", "value": "376968a612e976c22025dc552cf79c6eda5af8a82136fe2dbff48fd72afaacaa", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785262521, "uuid": "16466984-2dfe-4542-ac32-64a3016b37df", "comment": "Malware payload (WannaCry)", "value": "7ce58221e01efa4d0f3cb605530e295e62f1e662", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785262521, "uuid": "0c87938a-cdfe-4c8f-bf52-6a4c457056e9", "comment": "Malware payload (WannaCry)", "value": "b09f86b4bcc7430710f8149836c4a4966fac51773bfb3db319c7e726d3631d4c0de99c48d54ae15b76212321486a1900", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785262521, "uuid": "7246df8f-1bb8-4233-985e-954ee07b8b22", "value": "T147363349317881BCD106197844B78E63F7B37C5A56FEAB0F8B40867A1E63B45BBA4703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785262521, "uuid": "55289eb8-57ef-4192-9385-3cf95f0ca75b", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785262521, "uuid": "b593bee3-fbe6-4cc8-9274-3942e0331e41", "value": "49152:jnYnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhE:DI8qPoBhz1aRxcSUDk36SAEdhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785262521, "uuid": "879e41a5-41fb-48d5-9592-f7c422c70cc9", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785262521, "uuid": "833e49f3-0662-4339-8142-e3b27145bbf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785262521, "uuid": "722a7710-5fd2-4feb-9d00-63f108b02395", "value": "376968a612e976c22025dc552cf79c6eda5af8a82136fe2dbff48fd72afaacaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3a244d-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221158, "uuid": "8eb2c425-1631-4b17-95b1-92f3f28d9179", "comment": "Malware payload", "value": "1253350e8f7b8a3d1e376405bda645af", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221158, "uuid": "10babcf3-f077-488e-8758-5194c9fc62a2", "comment": "Malware payload", "value": "380e458aaef47dab81b9093690f1607b1e339c58c63105d7bdc3e02092f9a037", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221158, "uuid": "45967153-a19f-4f5a-a142-9195929b15bf", "comment": "Malware payload", "value": "8397d89fd40fbc5c6370b812034aed2a759fc911", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221158, "uuid": "a253cbe1-1abd-4b25-a577-2d7a0a5b9b65", "comment": "Malware payload", "value": "835a4ed34edb15aa890dd7c5f21d3b30cda97bae45bda354008cb28a1dcf77fc3007d9cd05e454f0b618d9f41bf61623", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221158, "uuid": "5d7e4dd8-0834-4106-af8e-f5d69011d47e", "value": "T18F72C04682846BC99E6212BF73E2995399050570104C77737AFA1668D7C58C6C3FECFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221158, "uuid": "4c90d78d-d87e-4e3f-b205-6e1e110dda48", "value": "384:j/a6M2JssqMgrSZ13A5s6+xZ7F456txISCwCCZLeSo:j/XT8MgrSZ1Q5s6+3F4stpCwLBeSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221158, "uuid": "9c1cc475-8838-40aa-8587-4fce52721b2c", "value": 17075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221158, "uuid": "54857a0b-ebe8-4855-bfea-55d3edf5e537", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221158, "uuid": "4d59e03c-8ef3-4862-8374-14a47d9dc32d", "value": "images_20260727_071511.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aae65ff-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785211060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211060, "uuid": "b6762a4f-cbbe-4705-9008-48f0c667d4ea", "comment": "Malware payload", "value": "9a1cf6b2aed871f62d603928f7951bf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211060, "uuid": "08355fc6-0d11-440c-b532-2e1811fd2a5f", "comment": "Malware payload", "value": "38af87c8b02e9b1fb7ab06416f7e747e1f84033fddefc8d580c630831bf0413c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211060, "uuid": "95b8ec8f-fa61-4ad4-bdd0-6924021382cf", "comment": "Malware payload", "value": "7bd41405ecf6b808d444f4638f538ef8e1e21386", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211060, "uuid": "b5ee5505-6a47-40f6-8982-61fa058103a0", "comment": "Malware payload", "value": "3ec58891eb7d6f9a9c46a36c73f970aa17eff36f85dbe5b5c6cc767f116874dcf2ca52dfb25d244b667913891f2cc7cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211060, "uuid": "ed56bafd-14e9-4d52-a037-f0e0367f52a1", "value": "T102668C17FC9545E9C0EAA23189628252BB71BC895B3023D32F50F7782F76BD06E7A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211060, "uuid": "af58be93-004a-4111-89e6-54fc01d416d4", "value": "98304:mHJOV6bhg4MDEC4batdEDbphbEJfIFzqlgqbBKBUt4NQ:V6pCZEfDbE9IFzsg2gBKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211060, "uuid": "825be062-754d-4eee-8126-2395dd088bbc", "value": 6524332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211060, "uuid": "d7ce8e64-5b8c-4dfc-b6cf-c5f3add43a20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211060, "uuid": "41069738-1eb2-43fd-b99e-ab6bad4ac956", "value": "condi_c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59618644-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1785224319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224319, "uuid": "71dcbb4c-8644-4306-9bdc-8c71d286def9", "comment": "Malware payload (DDoSAgent)", "value": "04bda04c8e069e023b729deebfbe599f", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224319, "uuid": "06a2032a-9f07-42be-be4b-accb3bd4dd0b", "comment": "Malware payload (DDoSAgent)", "value": "3943c2d985fa074ae971c4845b4704168035d3881b3411e726c7c51b4cd1ab26", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224319, "uuid": "6533e5f2-802b-4bd1-b50f-ba63088d2fa0", "comment": "Malware payload (DDoSAgent)", "value": "4113dbb2fb2775035faf7c6e8f4f4e095d5dc858", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224319, "uuid": "53035526-66bd-4982-823a-d9d5f4ecf2b7", "comment": "Malware payload (DDoSAgent)", "value": "0a09715efd4c89ef1659db114e869f269a7d1cc5f0d58f2276a5c502031145c67197bc2e4d9bd5ee4b3af982ee0332ec", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224319, "uuid": "850d4863-c0ee-4f50-ad95-ccc7e1a9a99f", "value": "T17E553327C3543AE320FD159769C190FBC37AB9EBFC60D493442A23626782C939EED645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224319, "uuid": "7fe9aac2-1a94-446b-a2f6-5087f958d3a4", "value": "24576:BX/KTZEdHUCSeTMAKiRPmyuObUY6AJgMkJXRP5o8J2BX1aaaPK2uUyJ:BSTZkVoADuOA2J6XRBoF1EW2te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224319, "uuid": "a85223c2-eb8a-4dfe-b9a7-fad8d6f7aeed", "value": 1352580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224319, "uuid": "2eda6f10-e5e5-4bd3-b296-790fe7a27ca0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224319, "uuid": "c560d41c-e9eb-4d46-8040-a359dd53427d", "value": "jbd2_sda1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7ed490-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220786, "uuid": "e6ed9692-abda-4379-85a1-f0064313130d", "comment": "Malware payload", "value": "eb6295d33a9a9f8343e061e7d6b49408", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220786, "uuid": "151fcef6-9e7f-4654-9019-48404623f2b6", "comment": "Malware payload", "value": "399311ab96f739198958c3dd04eca6d893d7a54ff11f33dc1b0a67661925d88a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220786, "uuid": "1f15d3fe-20a7-47fa-8883-a6a960c8cbb3", "comment": "Malware payload", "value": "f43baf6f607c5b5173c35e3be8666b69f33b23ac", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220786, "uuid": "22c5a8fb-69b6-403a-a55e-a5e5c125cc0d", "comment": "Malware payload", "value": "b101789e727be92c8ff8cc1ed57bf651ffa650485bc72a4b7d0c928f64dfb8ee210f59c3fbecd21f34bbd7b8482cbdf5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220786, "uuid": "d6665ff9-9df7-4a99-94b2-6ff78bd9371e", "value": "T1D5818F83D71CA922EC66FDB516B2AFCA9FAC514A7508783340A78784137F48175099D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220786, "uuid": "9e258fd8-0eed-4d88-b0f2-750b05410c97", "value": "96:pxmEv41bN+7gpHwdnCIbTScWYITayySvdSc6nIu:pxB8jwEsTWYIhXv6nIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220786, "uuid": "d153084f-e281-4b18-892d-aba0c5e4528f", "value": 4127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220786, "uuid": "f5d9b8f6-1f3a-494b-8d95-cbd439cc2fa7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220786, "uuid": "e0233d94-72e4-453f-8730-e89c132123ee", "value": "images_20260727_210342.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e342366-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220810, "uuid": "5cca5cdc-aa9c-461d-8ea4-2e07f66df5ca", "comment": "Malware payload", "value": "6b006d716b2a12bd2c198510292c0eef", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220810, "uuid": "01b96004-febd-41fb-800f-2a414415c3dd", "comment": "Malware payload", "value": "39c10a087495da8f70e91b45e9a719dd03c0f08ed301da673f1017a02381f370", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220810, "uuid": "a3842a0e-5bf7-4c9b-b911-8510d19efe10", "comment": "Malware payload", "value": "20583cffd36e949b755e9c186f6c8e0cd2f99dfa", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220810, "uuid": "b2b49962-deac-4104-8a4d-13330f36a0af", "comment": "Malware payload", "value": "3d23599d5cbcfa9def98ff8b000dc6541c4c482c045a7827c374fb7b3996bda5d30277939f2435c3b835fb0f3cc291da", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220810, "uuid": "00ae47c2-2550-4cd6-92b8-55e4c1a6d4aa", "value": "T10662C06698272E0CCC9510D8C9AE4D049620DF85D2E2B2C8FBFD544621BBE44E3BAF71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220810, "uuid": "b6dbcc01-14d9-4e9e-b0f8-2d20b280a2cc", "value": "192:rKNOu0mwE6nca+nFh36Ov05JuMeuIkxtFR02FJbDzxUrI2K0ZnyEQcY1owLkNn21:mNUmBtFh36RYkl2qJWrI0ZucCrA4rLKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220810, "uuid": "4e01b7ff-bec3-4f20-a17a-2cc58e2cd8cd", "value": 14576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220810, "uuid": "d0d6ea63-8cf2-4188-911e-5e2601a56c89", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220810, "uuid": "4c1edbdc-261f-4b46-80f2-327536fcdebd", "value": "images_20260727_120547.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92742e3c-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785245889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245889, "uuid": "e58d2c95-f279-4b71-aeff-5201d57abfde", "comment": "Malware payload (PureLogsStealer)", "value": "55826f5721538c8093dfdcb886ef2bd0", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245889, "uuid": "afe21883-6ca8-4d49-89a4-91c65bd01e0b", "comment": "Malware payload (PureLogsStealer)", "value": "3aa89c6ce9c39037c218719549735d5a3451f896683cf842bb03eea66bd8c6e5", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245889, "uuid": "cc89c46f-e7dd-491a-ac69-c52b6e9f94a1", "comment": "Malware payload (PureLogsStealer)", "value": "c77c6fc03202cbd47e01bf94f4cd1a38fd2060ad", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245889, "uuid": "4147aee6-5c3c-4c51-bcd1-cafefab56863", "comment": "Malware payload (PureLogsStealer)", "value": "30a1f86b095745156361758f5cebcfb073e51f941d4449dc25191d700ccba5a48357e0ba8ff3cbb964c03a13ba92bf13", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245889, "uuid": "f7265ea7-d870-4b75-89b2-c18e46abae34", "value": "T1BC26BF05F7D406D4D46ADA30CA6B9B32C7F1B89617B2C34F1558C70A1E73AA19F6B322", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245889, "uuid": "9ccb69cd-6cc7-43e1-ae24-e72f087695e3", "value": "49152:osW/a2XunPaAlBZiOK/sMeOgFVGAPFaTJfRRIf9miH4gvCwlH6:o2asFPFUSV5ImH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245889, "uuid": "ffa503f9-4f80-4292-96be-98502bb60a89", "value": 4544512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245889, "uuid": "e925c78e-d721-46a4-8378-bf24a3d8c2f5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245889, "uuid": "bcebe7d2-ecd3-438a-a84d-14e051f63851", "value": "3aa89c6ce9c39037c218719549735d5a3451f896683cf842bb03eea66bd8c6e5.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4e43d6-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785245959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245959, "uuid": "a8bbf1e5-db28-4505-8a69-6613e9f58f59", "comment": "Malware payload (Mirai)", "value": "79a23fcc0d5e2835d5c5f0aaf4c39118", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245959, "uuid": "20a97120-2264-4b34-86ec-967225905949", "comment": "Malware payload (Mirai)", "value": "3b5a989cf735d0eca24635469c1021c217794d373dcc7bbd89fe03aaecea3936", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245959, "uuid": "a8bef104-3a93-402b-8ad5-18abfab6064c", "comment": "Malware payload (Mirai)", "value": "862fc786a5163f29b598a53828d6161b6fbd29ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245959, "uuid": "0fb97503-62e6-4505-a5b7-416a23af36c4", "comment": "Malware payload (Mirai)", "value": "af8a3637ee3c3f9ab75a37a81fd6415e20a9fe2fa24b779be205ccd742eb9efe4d88ac816b53f81bc864fe41a96cac99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245959, "uuid": "04b12195-1b56-44ee-836e-7b078ced66f5", "value": "T1C0A3C81F2E619FBCF3A9823487F74A34975C23E122E1C684D1ACD5012E7434E995F7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245959, "uuid": "e465ad4f-2f91-40f5-8867-7cba23ad52ce", "value": "1536:cigVZBc8Cl+FubAuMYEiiH1lH/dLd8t7s8puFIEtrax0t9REx5j8:S8+FubhMYDQ1ddLunuFIkUx5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245959, "uuid": "03b37b38-07bb-43ec-af00-4348fc2dd3fa", "value": 101068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245959, "uuid": "161ff7f6-c22b-46e9-ab07-4d992ea7194b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245959, "uuid": "2761508b-759a-44d1-82f8-dd48cceceafc", "value": "Qva", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d120877-8a25-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785202877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785202877, "uuid": "866f1402-087f-4aa8-8168-b9c80bc8adec", "comment": "Malware payload", "value": "87004048a9bd8753ff5c50169b811b89", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785202877, "uuid": "b79b961a-0a76-4df3-ab02-50637f50e54d", "comment": "Malware payload", "value": "3b6073262e504853b0d13420eb6846ca0f799334b5038422e6a1bdd8bc505e2c", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785202877, "uuid": "c5dbbd7f-9a63-4b19-bae2-e9dbef973502", "comment": "Malware payload", "value": "a7ae76b01366a06780c0beb43f582afb9fb1e7ab", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785202877, "uuid": "76894d01-a5ff-4ba3-b60b-b51546077248", "comment": "Malware payload", "value": "19df5b172b2062979c24440c1735d2d3fa41111f2407978edf4437088fb0414e8f90d330ba6e29c358674a3deea28b11", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785202877, "uuid": "adf09c2c-fb68-467a-b79f-bf6c3a5c5800", "value": "T1AE0149DE90A9CA4007F4C482F5B8C409C4515083E1B69BC5F28E4D33EFA694E356324D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785202877, "uuid": "56921924-0aca-4b6e-8d40-875efe53cf9d", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+QEjfkAg5Atxh4ZhG+E6:FH8j/wWi2jz8IfjgGThq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785202877, "uuid": "af3cb165-e98d-4a81-b1e1-e59e93f68ca5", "value": 710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785202877, "uuid": "3711634e-0f55-4ca3-9234-c84fe0415508", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785202877, "uuid": "a12547e5-b1b9-49da-93d5-bb43896bb011", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff498f2b-8a6b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233187, "uuid": "846fc4ed-f992-4bdf-a428-ae35251c7dd1", "comment": "Malware payload", "value": "e1f223700a5348e2a9ecd42646be5461", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233187, "uuid": "ff2135e2-5d00-4907-b015-bf0d32ae944d", "comment": "Malware payload", "value": "3ba24a2d6b3d69872f77249d7fee630497cb7df5a4732472c71a0c7774dc549b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233187, "uuid": "1279b338-d426-4b5b-84ee-97dd7e161002", "comment": "Malware payload", "value": "a297a58eb8a116257c4fbae17eb1fd072e5cb0bd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233187, "uuid": "52663850-20b3-4d2b-b344-ae2a5b2fa34e", "comment": "Malware payload", "value": "fb8a75ff0f004d38bf968ee8e8afb73d7bddd479ae74f8f207dc94e63f6a12dbafb67688b743cfd1086e7bf114dc82a8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233187, "uuid": "2286f940-d556-4d04-9347-67d463bf5f53", "value": "T1E222BE019FCBFD42C97651214BA0FF7E5641BB630065B017A6FF6180DEA7BC55AF0681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233187, "uuid": "a17a11ac-f827-4d72-98e4-3be7391dde26", "value": "192:6t2uVKiSTPYVJaOk44cWCmyxIpqssqQZ47lhbSxpqeYSOpuc6vS3irC7v/bZRDf1:/ek44/Cmuusie7qeYRpDP3i+7v/bffPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233187, "uuid": "2aabcb79-0347-43b9-bf99-f0c0f572f49b", "value": 10590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233187, "uuid": "062417d6-b1e7-4bf5-842b-b5397632dce7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233187, "uuid": "f1ecac52-b624-4b4c-a6b7-c15b9bfaeb3c", "value": "images_20260727_122304.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f170c666-8a98-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785252491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252491, "uuid": "5cc56cf4-d246-4683-9b8f-00764048e652", "comment": "Malware payload", "value": "1fdda82ecf310919e778911bf0d8fa48", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252491, "uuid": "494f56e8-9057-449f-a8e2-0852b5b9ec67", "comment": "Malware payload", "value": "3bbe762e3f4ce5fab8f092f006fb07f5096a8bf2929e208c4917059cef2d89ce", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252491, "uuid": "31faf3d3-545c-4d27-bcc4-4cdf8d822fb7", "comment": "Malware payload", "value": "675d1a317c1c7a5a507145a1de0c7196cd363187", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252491, "uuid": "3a036100-9e73-4cb0-b117-246896e331a9", "comment": "Malware payload", "value": "6f93d861645269d4000b943b595dd462036e58fd2d85df352e5f6ccc871805055b89bc9f6c2fcad94c998bd9e1931e7f", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252491, "uuid": "1979c0aa-c7d5-4f8b-b44f-62d680bcdb20", "value": "T1B8D1C7F00662941361E63E4AFF8575CF9064E3B74EAD2AEA59A4704603BD803D0FEDD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252491, "uuid": "bdb31984-98c7-46cd-b530-f628911fa7b5", "value": "96:GF//vILKESdYaohPYXI7dJqMJNEFfy+sNJV1WRb6Uwjrg0yrnu6IaPPbwcsvkfic:GF/nrVohPYXI7dnQfPb0emnx+A4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785252491, "uuid": "777b34c6-7792-4412-99a4-b34cffa08cf1", "value": 6414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785252491, "uuid": "21a1bf08-d628-4b2a-99b1-6379fe995785", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252491, "uuid": "a9beadb4-72fa-4ba2-a049-04288dfe21a2", "value": "index.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa668d3d-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249795, "uuid": "921c21ba-a8cf-45e7-b800-f34a04c27cd3", "comment": "Malware payload (Mirai)", "value": "885338f688da4c1fe700a25188e0532f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249795, "uuid": "1dc430bc-796e-47bb-b0b7-30eb7c2c6b44", "comment": "Malware payload (Mirai)", "value": "3c14d6e7005b06662daa8d351ce3e1597a711bb92eac5edc77b9bc5f0ae0cf82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249795, "uuid": "1a07f626-2139-4c85-8430-85cc7e6ac29b", "comment": "Malware payload (Mirai)", "value": "ffc4cd8c802a1c025007ea2eb2c9a82f06c1ddbe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249795, "uuid": "b9e26d5e-f9fb-4ca5-b186-03f3fbe50673", "comment": "Malware payload (Mirai)", "value": "16211b2fc02007de55fa21044d6a4d66d2f0d4a427ac0ffab371e0fa941c539e998dca1b313ab6a629d80a9db283bcac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249795, "uuid": "20fe05cc-3adf-4d28-83f1-5edb4171bee1", "value": "T172D30789BC804B00D5CA26BAFE0E164D33535BBCE3F9B1039E145B2E27CA95B0B77955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249795, "uuid": "dec74e1f-2b80-4683-9ef9-472483a9417a", "value": "3072:Kjy85d+AnCHdImvoLmpMguHcUDVUHalw7W+uH0+sfCy2anfhnuWHC/RYLXQea/Gf:KO5oLmpMguHcUDVUHalw7W+uH0+sfCyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249795, "uuid": "75f877ea-9378-4ada-b367-d6c4d3ca9951", "value": 136824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249795, "uuid": "3cfbfd45-703e-47a1-895e-56a00558cccf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249795, "uuid": "7ebd8313-9ceb-4c35-b9b0-11577da6ce46", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43f1862-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785211157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211157, "uuid": "f3d3fb69-d064-4b7b-b891-5673eb24845f", "comment": "Malware payload", "value": "a1ebbbd9d73db110c0c7e1151d433bd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211157, "uuid": "8cd76f41-54d5-42e0-a187-b67ed00baa81", "comment": "Malware payload", "value": "3cbce4117e94894afda82e30ec03c283591c302f20d3a592232decd56c6c98ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211157, "uuid": "51260694-9de1-4c4d-9a3f-7b984abb88d7", "comment": "Malware payload", "value": "e3527886f0c590b3f4e3da15597c23015c30bf4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211157, "uuid": "8cfc592f-ed8b-451c-af06-5cb2c9c4d322", "comment": "Malware payload", "value": "b835de1aa67bb164bbe8ac5e07db4b7695199ed06e19bc143804a132579d24a594d19ba59cfb936d2b5d75540ecf68dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211157, "uuid": "34ad8b75-05d5-4a23-95ef-5d0de3a6ee64", "value": "T19B54235AD48925F9F8569FBB698E700CF706350C803BBF81E9CE58DA05E1AB8AC05C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211157, "uuid": "eafc4ef0-23af-4d18-b0b3-85ce03ece379", "value": "6144:EToWHuHsqDyOdQ9akBDeHIbfwhFv4fCamgha:jWHKSaADe4q4fCamJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211157, "uuid": "377c1d53-4365-4af9-b9da-c735c56fd64c", "value": 281868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211157, "uuid": "a7498d01-1dab-4366-b307-95df7dc2c400", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211157, "uuid": "1be7f45d-32f8-4a4b-8778-ddb16af2bcc8", "value": "dlr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab743d9-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249715, "uuid": "f559aa75-805a-425e-bbf4-73a3bffdfe9a", "comment": "Malware payload (Mirai)", "value": "6dda3b462e6cc2539e965d5498d8e5e9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249715, "uuid": "01cca023-294c-4d4d-baa6-8566adec4591", "comment": "Malware payload (Mirai)", "value": "3cc6ec7c780429ccbb5a77c28426d8f65aead942cd4129b28bba13f8db6c3144", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249715, "uuid": "a668d48e-68a1-4368-bbbd-c3014b819995", "comment": "Malware payload (Mirai)", "value": "5e52ab0a37571a206041f2bbaa2cc9f013e0ceca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249715, "uuid": "e8ede65e-de17-417d-8d35-9580693c03bd", "comment": "Malware payload (Mirai)", "value": "696f84361338cee03c83146ec7ad1a1d0f7625ff0bdebc2d741ac2f4d56afc8c660eebb47e58f34e747ffbdc54b22e2b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249715, "uuid": "23612376-40a4-485a-ab13-3c12d2c6ec83", "value": "T1BA73FA15ED7C2A27C2E0313641E74A61F5B213DD1AB8A68F7FA71D0DED24260313D9AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249715, "uuid": "1233c447-1616-4e7e-ad6d-5b62e7d262c4", "value": "1536:53OOkxnn/mFsL8mtIUUquKA1nyBci0ROYzSA:53pkJeUUquKA1nyBcJEcSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249715, "uuid": "d73f70bc-5386-45a9-9781-40cac5f2ce51", "value": 75840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249715, "uuid": "32b8e3e5-6e4f-4f6e-b345-e4efdc2bba4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249715, "uuid": "1445907c-479d-43c1-9d90-4eac4849aebb", "value": "zero.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842131b1-8abc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785267770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785267770, "uuid": "a9ab25e5-ed1e-4ed7-912a-5c61cde8bbf9", "comment": "Malware payload", "value": "2a31dc14cab9edf5821a97fe6ad9161c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785267770, "uuid": "4df72fe4-baa9-45bc-b66e-45978abe7498", "comment": "Malware payload", "value": "3d4c5602c640bf6f7787546e82e65c5436a08f90f19089c4f185e0e12132abcd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785267770, "uuid": "4a033e3b-cb10-4934-a463-367ce93a3e0e", "comment": "Malware payload", "value": "8f4784412679f8394cbb042446e3d230993c0f39", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785267770, "uuid": "116c450c-170e-4848-9098-d921bb0adf49", "comment": "Malware payload", "value": "0f749c01710dce7b5bdf4effa55e76f982d6dfc400e6e91bef29e765279277b6114ebb1a1394db17effee7809ba1c3a6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785267770, "uuid": "0b4fbc5b-25af-43b7-8fb7-b91d8da0ba80", "value": "T18A236C651A857C149E98C4371D7E2F0CB9AD43E6320852DE7FCB3CF68C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785267770, "uuid": "1e928fd5-17e1-4b7f-88ad-acdfaf8f044e", "value": "768:dVEJVIhtMU9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:zEJ2MZcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785267770, "uuid": "f15b5366-b368-4462-895b-16a5fe38849d", "value": 50083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785267770, "uuid": "d3da5af3-85e3-486e-b71d-20eabbd2c5e1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785267770, "uuid": "9b46b500-a4b5-44fe-a46b-2f719b8cf283", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad61a10f-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221024, "uuid": "49b89e94-f1f3-4d23-af9a-d07736223cb2", "comment": "Malware payload", "value": "4e106f44d1bd546dec2157d01b773645", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221024, "uuid": "dd09e9f0-3a1a-4e6f-ac7b-7def1d267f59", "comment": "Malware payload", "value": "3d65cb817e85395d97bd8a54d5fa8ed0da3fea445ce87a0dbc7561352ea498d0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221024, "uuid": "2b4c1851-7ec6-49d1-aa75-2e6a2dd96f4b", "comment": "Malware payload", "value": "c3261b97519e82c529b191621131a424724a95c6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221024, "uuid": "9a844892-f132-4ec6-8cee-1ccbaa3117e9", "comment": "Malware payload", "value": "5173afb5a6ace805d82b799e45572b7e9c0574617249ee33f298e8968cd94bef27538f6dcd1875704916cb2d05f30d8c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221024, "uuid": "e00092bb-1d11-428a-bc25-e7ce9c94849a", "value": "T11942BFE05609B341DB4F513689A1FD5D261874C30F273B9FB2E965F0B1A1E40A67C2B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221024, "uuid": "e84100c2-df37-4c51-b7d0-88f6edbd52b4", "value": "192:ITIL3OokKkaDasxt7rUGoZ1B2MNKgCD1vNZgcGs/oiTri1+AYUjhBM0+LxI4FBV+:+IzaKracVh2B2ljHZgc9riJYUjhRFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221024, "uuid": "4b32b306-b33d-4833-82d3-17adc77bfe79", "value": 12731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221024, "uuid": "50b76220-926d-4c43-b5d7-ec2eeb3e530c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221024, "uuid": "2f5ed08b-c854-42d2-88d1-6cd179498d98", "value": "images_20260727_203731.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77ce575-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785211135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211135, "uuid": "2f01ddb3-1f8b-43df-8237-9c7fa3eb5be2", "comment": "Malware payload (Mirai)", "value": "51b845648db26eee79f92c15c480cbc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211135, "uuid": "54d35c28-2aa1-436e-9161-6bc39101f587", "comment": "Malware payload (Mirai)", "value": "3dc78d3eb8529ae2ea19c7d2584d5bcc92179cd518cc81ce3189c88b5aa4b595", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211135, "uuid": "8e10f555-a4e9-4984-a5f2-4a2305c5281d", "comment": "Malware payload (Mirai)", "value": "4333fae63535608ba69879e12a04042d2c6c3b61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211135, "uuid": "fe02a6af-1484-4630-a363-a21f25f74238", "comment": "Malware payload (Mirai)", "value": "2dd564184e348356d091769089780f95de3d94abaf23b873b4ae0ca8355efd3604a2eec706c034a097d1043ce4846a82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211135, "uuid": "94151585-b137-491c-950d-184977700935", "value": "T1B2E47C5BFE9E3C83E2D6D37D9F4AC3B1A22BF190C22351533581422C95CAADD8BB0655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211135, "uuid": "30dbee05-ab01-4165-b287-ca38bdf73c2b", "value": "12288:dOx563WCLiUNHSUWWHnIlw5GfNIrEB2vNeTH:4O3W8yU9Ih6vNeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211135, "uuid": "8e487571-260c-4351-9aea-a3a251042366", "value": 701680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211135, "uuid": "6bcf40c0-bf18-4b67-826c-6dc95f30451f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211135, "uuid": "7104f4d6-dd0c-4f95-8f2f-c7285a23e401", "value": "dlr.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf272e61-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221053, "uuid": "b8e3ebc2-0d0e-4710-8139-a1dd4ac5f288", "comment": "Malware payload", "value": "85bc7dbfd0d1ab5a1d2ea5fc98f37b51", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221053, "uuid": "1d3e5069-390d-4d08-9793-1f313838d882", "comment": "Malware payload", "value": "3ef7b2b6aae7a8b62dabc705d23a2dd0e160036ca685b3cf921df60c1a9b8beb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221053, "uuid": "34d40028-ed05-4ca4-9997-231354472db3", "comment": "Malware payload", "value": "b03c98fad1fc1d7df37edf3e440d0f7de8f5b5fd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221053, "uuid": "ae3e58b6-27da-4013-a8d1-698226a02a88", "comment": "Malware payload", "value": "ae001f219df93febf5603c9b7fb7f724d30f6b3835e8f731d7df8b6d1a0f3d8bba96df953a2ccd5876b7f006192c761f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221053, "uuid": "7d613693-557d-4ec5-97e4-ac9b15b19226", "value": "T13E31E71197A12C4BF47B90FCA5E31FAC0679850A65C1E293FFE82EA9425319182470C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221053, "uuid": "2faba553-ea9c-46f5-ad15-c03b578af3d0", "value": "24:9ztReJkf7QKHK36Ek5ivj1H+DXA11NsAjhvlLjkenhx1IOj72QQfz85TeNyvp2x3:9h48Uk7TAfdlLjkExqOj7JAo5hW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221053, "uuid": "e3e27585-68e7-43fb-bb6f-afa84c81b9fa", "value": 1833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221053, "uuid": "b99286dc-050e-47aa-9eea-c8c5f9cab1ad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221053, "uuid": "5b36b610-c156-4b4f-a0d8-eae5e54c5599", "value": "images_20260727_063948.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbc93dd-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220863, "uuid": "dcf705e4-d598-46c8-a1e6-d49f879185ac", "comment": "Malware payload", "value": "d11f6086c1959fa784bb67e02064af31", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220863, "uuid": "77b414ac-1342-4d8b-a56c-c289b4655af9", "comment": "Malware payload", "value": "3f05786bae1090a25478b4b6a774bdf3fbd01d628723a5fe1dabdd6f688320fe", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220863, "uuid": "ceed2c16-0e8b-4f03-9ce7-82784f676f44", "comment": "Malware payload", "value": "8131a72a716c7b9b5c3fc27822e76e0c83d818c3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220863, "uuid": "04357f65-150d-4f2b-94d3-3cbd772503d1", "comment": "Malware payload", "value": "bf6528ea92705ac4594db79fd26a48fefc867855a226b10e0c5ea3cdd7b6669ec2ac3bff73e467c829e874c08a5fc655", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220863, "uuid": "ca526655-042f-443b-a6ea-b7932df40519", "value": "T17622C047AE1C9362E3E1B63948E135625000A2E7877377499ADA30F85CF7BC0A755C85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220863, "uuid": "b70cf71b-44c7-4311-ae4e-b638b8477bea", "value": "192:0YgOFEdvpx1F9ENVdJjLt1WHaD438tpR7isX1tzBopfwpPS8rGw:0YJk7F6NVd1x1e8fRR1tg4p6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220863, "uuid": "e6a0d923-e7ec-43d6-9a36-5075100795cc", "value": 9929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220863, "uuid": "0a9558b8-58a8-42dd-8950-18bfd495d119", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220863, "uuid": "f86ec96d-8323-44bc-8284-c0e0b5a1597d", "value": "images_20260728_035153.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d7bc6e-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785245655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245655, "uuid": "25b0feda-f54e-4359-a25e-fca693953323", "comment": "Malware payload (PureLogsStealer)", "value": "234d3cc64ff2bff76866cd1e991ebbf5", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245655, "uuid": "95213c7f-10d2-4045-9e02-b569e3e0e65f", "comment": "Malware payload (PureLogsStealer)", "value": "3f95a86fb5a628574736c53ce3d4b54a9e039caae220c64b55f03d9490fffb9e", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245655, "uuid": "dabbea1b-9268-489f-a189-127e570fa75c", "comment": "Malware payload (PureLogsStealer)", "value": "234a031dd61d249612e1a415b4957790a1ca1614", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245655, "uuid": "a19e2250-ad44-496d-8cba-5a691bd39bf1", "comment": "Malware payload (PureLogsStealer)", "value": "875fb40a552ed46a56fec982b56da8fc788f57ef1f76cc12cb093baf5267d75aa8692333314332ea552f96c9ef8f4567", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245655, "uuid": "dbc6a20f-8a9c-4dc1-86f2-c8b93f114ebd", "value": "T10106B092B3C46AE9C456DD399714F232C1B2BD234BBAD0CA5D96C70A0E7AD514F3EB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245655, "uuid": "fc747fa2-6d5a-4853-8dc2-a79a7d889910", "value": "4552edb7ec47163e14feea3fcb7a0f96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245655, "uuid": "d5a74753-de8f-4147-96e1-15129fc224ce", "value": "98304:ze3QEuLVsR1GRPNgTOzai3VY4ekajO+LZihVWdFVRchY7adH1qe9NTyzDSHf3sDF:ygEuLVsvGdim3lXe1S9VWdFVRch4GH1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245655, "uuid": "0f83d951-233b-4a71-9376-5e90a8a81bba", "value": 3697664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245655, "uuid": "45d01cf9-e1d9-44a2-b70d-66821050c234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245655, "uuid": "338c8a06-0680-4fbb-86e7-5c83f311b892", "value": "3f95a86fb5a628574736c53ce3d4b54a9e039caae220c64b55f03d9490fffb9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6239e658-8aa7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785258693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785258693, "uuid": "7abcb97e-99b0-4021-ae7d-9288de519790", "comment": "Malware payload", "value": "89c19e19fd139aae3ceca017e153dd2b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785258693, "uuid": "867f95b9-9d1b-4506-a2b1-93e224032100", "comment": "Malware payload", "value": "3f9c1112d0fbc05dbd8e22e510a215694944f8effaca8338aac6f894afdac809", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785258693, "uuid": "f33c5e79-7826-47ad-86d2-f9c7a295c01c", "comment": "Malware payload", "value": "66e2b0f59a47a427e10b8b7e8f2d55ac96f42abc", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785258693, "uuid": "a2014aeb-09ca-48d5-a4c7-bf41aa2436af", "comment": "Malware payload", "value": "beb373ffb25f9d0699c9c772d4ecdd24e0a7b68a7f2a03d2d911a3cf96b20584f9d128a40a4e82319a3065a1c25d2f4c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785258693, "uuid": "c2383f72-d989-49e2-88ec-1234999e0295", "value": "T138F4234A9E7FD9414B01B97585C6040EFFBB39DC0E0F790E4DD7398FA1AB47A8498A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785258693, "uuid": "a9def369-3668-4db9-950c-206850a545a9", "value": "12288:FkPJnUpEUjyvYjRn4y0H2CRpAF6bpsKyL8BYCNnUwbLCmB1wtnP+Z6EPU8tnY9:QdTUmvpH2CRpACCKtBtUeWG1wtNE89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785258693, "uuid": "8c95b040-d639-42b7-b200-b052194a0a7e", "value": 746353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785258693, "uuid": "c869785b-8cab-4083-a2bb-72d2d4257cc5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785258693, "uuid": "5d4fe58a-a3f0-41f4-994f-01cd8ad947e6", "value": "Actualizacion_Datos_Bancarios_28072026.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5834981-8a93-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785250350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785250350, "uuid": "f0a929ac-0df4-467e-a963-d022e905c6e3", "comment": "Malware payload (Efimer)", "value": "5839887f0a72b6e522074c4346850603", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785250350, "uuid": "f9d20a0f-5d15-4546-9fd7-f4a6d8192762", "comment": "Malware payload (Efimer)", "value": "3fcc93723abb9c679e5e310a0c1a7089e858fb9fa9cd34f9da998f1cfb30c5eb", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785250350, "uuid": "e92e2015-0c56-4476-b245-53e1ddc1c719", "comment": "Malware payload (Efimer)", "value": "f844807a5ccc2a3f1516c3a61dcd42c694e6a4b9", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785250350, "uuid": "86fab968-3717-420a-acc5-99d061620d67", "comment": "Malware payload (Efimer)", "value": "5d6b1a029a49e96b5a8d1385e4af4f95059e075ee37ac7ac77b734d8b22425bd077b8dbfc728dab05d2578b8d1fef74b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785250350, "uuid": "ce84fbc4-16be-44fd-9fbd-1336d40acbe7", "value": "T1D1E633485EF412FFD7B38039EEA1A1C2E16878761B32C9978B9443656E6B1C09D3C277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785250350, "uuid": "ee0185fc-6b76-49d5-a859-73c8f368b7ff", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785250350, "uuid": "4e0cee87-e3bb-4559-a547-4e859b5a5758", "value": "393216:88sDgFMlbLhE/fGYKrj0fXMCHWUjXucuI3/PGTAI:8xiMlbifeAfXMb8XDH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785250350, "uuid": "9274f3aa-3850-4894-8372-8cb2629b6d89", "value": 14288082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785250350, "uuid": "acf1f725-b763-4a06-b9aa-44dd83c30f99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785250350, "uuid": "ada9656e-42f5-4251-b5fb-17a2651c35e4", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5aa85a5-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221145, "uuid": "23a914bf-287b-45a3-b693-b15d8224b47c", "comment": "Malware payload", "value": "4a740b0113a3a6471c99939ba05a40d0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221145, "uuid": "414a4c24-6c44-40d6-a616-112bad4e7499", "comment": "Malware payload", "value": "402721c748dacb333b9e5961d59ee6e0581d2421211ba45389614a87c88d5dea", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221145, "uuid": "18136cd1-c50d-4bb8-bc46-ee8d67a157b9", "comment": "Malware payload", "value": "e36057b84817aaf8c06a7fec8b979b65d393b08e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221145, "uuid": "f295146f-c605-44c8-8f3a-964b3bd3c0b7", "comment": "Malware payload", "value": "341e157af7bb9d4a142855ce01f947b134bcb71993e4223f022aa9f826f0abbcd3265aed1683a9654cd83aa93d4a92a5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221145, "uuid": "a60ef67b-2c7e-4695-921f-eaf9d01d726f", "value": "T17EF18EDA71F9D064E0942F782B5B8F8C0661201AE7D50387B51F40D9F87B5FEA9266CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221145, "uuid": "289baa8c-1b99-4ef5-a85b-e67b3bec922a", "value": "192:hhf4a1K/Y794Pcq77KaE7b6Ge/FC/uvNafCVDV4Q3tAu3rhJ:h6aqYct77Kjfze/U/uvNZ9h9AAFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221145, "uuid": "1ad4a8c8-bf49-4f76-b4ee-ec2cd6b4d36f", "value": 7796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221145, "uuid": "119be80b-8993-4e76-99a5-beac3ee802e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221145, "uuid": "4031c521-d34a-4162-8758-2f373db7ae09", "value": "images_20260727_093845.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07527edb-8aa9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785259400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785259400, "uuid": "66735998-9e3c-4b65-ad19-98f47a366827", "comment": "Malware payload", "value": "08111e5e77d43943ccca53b3ff9d88ab", "object_relation": "md5", "Tag": [ { "name": "5b4fb2588db230fe432b570c78f1b4e9", "colour": "#4E6E8C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785259400, "uuid": "d08f929b-c25c-4775-9a22-8300f18937f7", "comment": "Malware payload", "value": "407aaecabee599cb29dbb3cf177ed77b67f65d63f456c7abeda5834c0d36ed5f", "object_relation": "sha256", "Tag": [ { "name": "5b4fb2588db230fe432b570c78f1b4e9", "colour": "#4E6E8C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785259400, "uuid": "aba48494-768e-4f5b-8a7e-66fbf74af5a1", "comment": "Malware payload", "value": "7939868adf7745235dfee34a557a50314ce9352f", "object_relation": "sha1", "Tag": [ { "name": "5b4fb2588db230fe432b570c78f1b4e9", "colour": "#4E6E8C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785259400, "uuid": "8e8d6ff6-b1eb-4b5e-9d17-b26279e7c090", "comment": "Malware payload", "value": "e7caeb5f53868d999eda9ab90fbc3a371ed26a20a47431a8768f07095421c5b48ddbe3f0beae28b4f209743b0cc98fd2", "object_relation": "sha3-384", "Tag": [ { "name": "5b4fb2588db230fe432b570c78f1b4e9", "colour": "#4E6E8C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785259400, "uuid": "c5bf84b8-8137-4aa8-a9fd-e66d9b9273a7", "value": "T16986AD1FA2AB15ACE127DA38CA617232D6B1F8460361A58F0658D2F51F33B909F7F315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785259400, "uuid": "475ddfa2-9508-4034-9b9f-9405a879f300", "value": "ddd051506cfe33d151858512722b97b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785259400, "uuid": "d74e9426-ddc6-431b-af7c-42b88516a17c", "value": "49152:YsibjnJ/wvmYovBITLm0fkL+8iYWQ1SE61ki:4J8wHcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785259400, "uuid": "1ae6d98f-5070-4de6-83b7-5f3694bb0be4", "value": 8274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785259400, "uuid": "3c1b7f91-2a85-4453-9431-dc5fb90ff1f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785259400, "uuid": "cd6a37e1-9626-4094-919c-23e80832c0bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942449ca-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220981, "uuid": "039e9d48-ab06-4cc7-8fad-0893477a5a99", "comment": "Malware payload", "value": "1e633745561bbbc78c7176bdbc1508db", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220981, "uuid": "73f8bae1-bb5d-4e87-b950-499b7de599c9", "comment": "Malware payload", "value": "40921a67e724ed937ffaf173aa12caca8fffd3079af326b2ee5215d573c590db", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220981, "uuid": "2d3e683f-9da2-4c0a-99e6-7f3292914430", "comment": "Malware payload", "value": "83139dd54fcf08e888a30e8c2b6ef40a2145b065", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220981, "uuid": "90ebe5f7-9c84-4326-867a-01873370607d", "comment": "Malware payload", "value": "2568f980e923dbb270f6d2ab5ddcbaf4477299a8fc5615963b6ffef6256d939b831208706a26c47d61406970601e67bf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220981, "uuid": "46b4a855-218f-4a81-9452-4c05fedc7b57", "value": "T16EE19E5466F65C23F2E37B356AF712384BBA19A01E1673CACBFD188A885A413C11C0A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220981, "uuid": "aa5e3f36-af0e-4aa9-9f37-00573dea3c33", "value": "192:M/ZhGkIF66PScPG51EGQ2foTqDTgYFv2w8CYajOia:ehg+OogTu2RCYayia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220981, "uuid": "b47b9bd4-bda0-45c8-8668-dd52ca909913", "value": 7251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220981, "uuid": "e2c13554-b445-4354-8561-721ff0d3dbea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220981, "uuid": "0a9bd559-e655-4f90-8c34-ab6c18143fd0", "value": "images_20260728_050541.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe47ca0-8a96-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785251334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251334, "uuid": "8520e1be-4ddb-4dc6-b8a0-071a6ea30570", "comment": "Malware payload (Mirai)", "value": "7bee6ae8d8d6590531afbd77e236eda6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251334, "uuid": "ceb13aad-371d-4bd9-983f-9a98bbadde68", "comment": "Malware payload (Mirai)", "value": "4166271006e249bbcd116d3e9e79d8c4267fde5fd78dc587d45c48909e0bdcfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251334, "uuid": "062f5d0d-5ff8-4ea2-9db1-169b34f0eaee", "comment": "Malware payload (Mirai)", "value": "2b206c2e40b9c634b07d2d17c0518e5c00535b5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251334, "uuid": "80fdd26c-10e0-4b27-9ce0-8d042f9193a3", "comment": "Malware payload (Mirai)", "value": "fe2d75797008e0a1f66acc9d197f9af51284092b6112001fc7bc85639d9876f96a837298b2c9d2e98d59f46f9fe74087", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251334, "uuid": "0bf2649d-d996-451f-91aa-be63117498b2", "value": "T12B0419C7F900DDBAF80AE3374853080AB130BBA158929A777257357FED3A1951477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251334, "uuid": "0286f5ec-f81a-4904-827e-f7b6732b1f2a", "value": "3072:xH8RHVV57wPoAVEu2+PzRyyE5BCOyN5dVdKq2K7NQVgjbiALivBdRCB:657EEuNyyoBCOyDdTn7NlL6XRCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785251334, "uuid": "08fcf815-8068-49cb-8c26-ca62dc56f1e0", "value": 180388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785251334, "uuid": "8bff3c4f-9641-409e-9fd2-cbdd15716913", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251334, "uuid": "726ddd73-a437-44e7-9db4-b4e579851200", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116fa930-8a7c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785240089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785240089, "uuid": "53a09a13-67b3-427e-bbd6-31bcced05934", "comment": "Malware payload", "value": "3e9b3306644b1a4d8c3ac23c7e0d4c7b", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785240089, "uuid": "d618ff62-eff5-4ae7-9044-abf480401755", "comment": "Malware payload", "value": "41dfa4fbcc8c68d98a2e773bb2de3df0b136ee9b608351290738d953ccbcc309", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785240089, "uuid": "fba03703-9a46-4f7e-8f75-392aff7997f0", "comment": "Malware payload", "value": "795981d6a13880fecb05adaa8503e72c9524ba11", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785240089, "uuid": "8eed78bc-756c-4968-8ca9-6225be14df68", "comment": "Malware payload", "value": "2dbbb66d6840431b2a5bca5a4d5369a29c8280187a2809e192fde8f148f32a84327581976512c2e3ce24ef4c52d41e67", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785240089, "uuid": "79fcaa17-ce79-4b37-baf4-e9c97b80336a", "value": "T11863BF33CB90F50AEA914D3074E31782C676BCC7D65226632EE178526FB26A035A3D67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785240089, "uuid": "2c5c0bf0-3341-47a9-8019-f075f79a50d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785240089, "uuid": "6c367d0e-ed76-488c-a4f9-3201989a963b", "value": "1536:+GtnRP889vcZITJMt/V2hbJae04KgjaI5grIN7KPxO:htnRPF9EVnb43jaI5grINqxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785240089, "uuid": "73781c26-2d6b-447c-a8d8-e14382514d1a", "value": 70424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785240089, "uuid": "b22c381e-1640-41ab-bf6e-7513cc5af763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785240089, "uuid": "f28ce48b-6443-4afe-a3a7-5b315ab68e12", "value": "chrome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f1b9329-8a73-11f1-bd95-42010a9c0009", "comment": "Malware payload (RuRAT)", "timestamp": 1785236381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236381, "uuid": "a7398531-a49a-4ce7-b14d-5c1bad19fce7", "comment": "Malware payload (RuRAT)", "value": "864158094e09512792570b2fa7791ca6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236381, "uuid": "f5abff82-4d36-4b8c-a37f-78c62e810d37", "comment": "Malware payload (RuRAT)", "value": "42a2e61a257eb64229a74a6c633e0420cc5ed217871d36d1e4e4577ae494421f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236381, "uuid": "ed76a147-4a6c-470a-88c9-e1af75a051bf", "comment": "Malware payload (RuRAT)", "value": "aa213b51f38739dcb8d371f060b4ee78bdc39832", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236381, "uuid": "23f790d6-388b-4b8c-894c-dc20a66dd1f3", "comment": "Malware payload (RuRAT)", "value": "3c8e33fdc1e72bef0d5f85bd3cf9c3793f2923688ef81541ee88117ff2ab75f176e03caaee8b2039491dc7edd4627243", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RuRAT", "colour": "#03BE1A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236381, "uuid": "70ccda75-b524-4508-b988-50219b9e2aba", "value": "T117571285F6518879FA5F0231A6FABF08547BFCEA13D4624934E8B118A3E3ED90D520D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236381, "uuid": "9783908e-bf33-4df6-9d9b-be1e89d99163", "value": "393216:Np1s7O5Sz3ds708J/LrRQLJg3g9DGH0bpZlJjfFx3O1lP1ICVmTovfYwOv4QS0V:F1qNgBQL+3g9DGHWjdxyICVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785236381, "uuid": "8757468d-b354-4db5-818d-419fda5c7cf6", "value": 28986880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785236381, "uuid": "f9e33e48-7a31-4453-b783-fcd1396e1ad1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236381, "uuid": "533302f6-8a15-4e9f-b620-522711979636", "value": "6.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f43e44-8a96-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785251346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251346, "uuid": "98f9b6c0-7561-4119-88ee-9214632e503e", "comment": "Malware payload (Mirai)", "value": "800f2a9585ced8f5b3c03276cdac5378", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251346, "uuid": "cc170e7d-f5d7-42ed-a286-321ba2f8ba3c", "comment": "Malware payload (Mirai)", "value": "4384da0552f022d58ad333a0b9944a214aa5dcc26dba6a955568241c14ed5179", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251346, "uuid": "35968cee-82c6-4f7d-8486-e9f0166d8af3", "comment": "Malware payload (Mirai)", "value": "86215604a35a02a844b4d3b00d2d8536ffce7e8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251346, "uuid": "de7efcba-668e-4b57-9e19-a70732438ca3", "comment": "Malware payload (Mirai)", "value": "15811db399b3a491d1a6782eaee1dc347f6aae4d8b9ca65c47fb9b00ce7e9146d55017861473bf93f3f74cbda20c0217", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251346, "uuid": "8b55a7a6-708d-4af5-b869-9a318103a8a3", "value": "T13FD35CB3C8296E5CC565E5B1B0308F791BA3A95041871FBD69B7C6748083ECDF64A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251346, "uuid": "81cbc3cb-3ce1-4625-acba-3d093aaffc27", "value": "1536:FYPpyrd7g78ic98a//C6K/BIQ7q5rq7sBI83WUiTlgWwjcz8KQ1:6Byp7g78b8s/4/jKq7s53W9TlIju8KQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785251346, "uuid": "28af929d-aefd-47f5-b625-dec8b14b922b", "value": 142140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785251346, "uuid": "3dd35222-be10-4055-be3c-d63a06a6693a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251346, "uuid": "3453e0f2-b9e6-4638-b4df-964391832459", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ee12bc-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220855, "uuid": "161c96d3-b845-4578-bba5-49d637792018", "comment": "Malware payload", "value": "0b4c69a2699aed122aaeed7ced69f727", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220855, "uuid": "5800fde4-a41c-4b99-8642-76e9e88b5ad3", "comment": "Malware payload", "value": "44c4aa0e2be3ce015173fb4b28a149b3a2d2f6ae6a3fb378c6e425759dfec9aa", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220855, "uuid": "d1e75508-c335-418c-b61d-ff1280ff51ed", "comment": "Malware payload", "value": "36d435795cc42206d54f228f78746b865dbd60a0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220855, "uuid": "02c6cffc-ccb0-4a74-a5cc-f7af6206861a", "comment": "Malware payload", "value": "ef97ef584747ccd038e82ff6660e200dbe1883ca0da0ef379814c39b94c9f9dae7afc7062673390455af4f5707c925f7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220855, "uuid": "348f65fa-4912-4c7d-b875-00f45730b684", "value": "T1E402BE84BD249531D8C63DBE673C08D8DEAE15391E8C12050B3BA76EE090F4E08D5391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220855, "uuid": "47f94ea5-9b48-4275-8bff-8674d07cc44c", "value": "192:lE58xF1onFwjQAGb6dpP/0/Jd+x5l4X0Dzf7pg2+lVIt:eCJEwGb6d+/vM4+zf72It", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220855, "uuid": "46fdde55-83f9-4178-ad26-a9b179f2d36e", "value": 8935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220855, "uuid": "ffab78ff-94c6-4821-9b7b-2859b8ea3938", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220855, "uuid": "2c205a00-ba42-4a42-83c6-7181a89c953a", "value": "images_20260727_091636.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242bf137-8ad0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785276198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785276198, "uuid": "c32adc4d-be16-4442-80d3-79d516ba371f", "comment": "Malware payload", "value": "e1e7b8463782585cae61d8c6dc011323", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785276198, "uuid": "5f6d4dc8-d845-4ad2-a76c-1da408313e80", "comment": "Malware payload", "value": "44c62e465a3ad8c8fe0f851466427f132722d21c416220c37f1c87a95ecd45ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785276198, "uuid": "3e771f5c-70a9-41a9-907d-c28c87f57a3d", "comment": "Malware payload", "value": "1a4f8b913a8c334ed755219a1feb558ddb292568", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785276198, "uuid": "3bd9eb55-fb0b-4748-96fe-971eb36df087", "comment": "Malware payload", "value": "feb1d8d04fa2ffd6fb356369a8f9a3cf323b0f368dd908efe5269c5affd65943c9f290eb679abad297ff93589ace31da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785276198, "uuid": "d20984f9-0413-4979-a5c9-48dcac4baf29", "value": "T1BB17BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785276198, "uuid": "e308638e-b34a-4a14-b034-536b216e8159", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQQ:cqYUQuVDt0TZEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785276198, "uuid": "d822c989-a30d-470e-9f9c-8ee5dbbe6607", "value": 19628032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785276198, "uuid": "4dccdc5c-661a-4de2-ad33-5b2f9c37fa68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785276198, "uuid": "ea765f9c-573f-4d96-b242-3c1359f2aaf3", "value": "44c62e465a3ad8c8fe0f851466427f132722d21c416220c37f1c87a95ecd45ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69defe4a-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1785224346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224346, "uuid": "5b38ee44-55ff-4f44-ba8b-52392e92590a", "comment": "Malware payload (DDoSAgent)", "value": "639eacf4325a5b1d46e80ffbc5b2acaf", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224346, "uuid": "eaf1de89-5f93-4ac1-88ad-605844c0e994", "comment": "Malware payload (DDoSAgent)", "value": "4545a76be98fa99e7dfe15c73bc6f90e5d6dd365b53e941795880d685e55d365", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224346, "uuid": "87c03b2d-27a9-444a-be6d-2b1298121f7d", "comment": "Malware payload (DDoSAgent)", "value": "4aafa8600cd929b1025fdc39e20fa3f7c677cb90", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224346, "uuid": "0ae01ae1-cf55-4cf6-9adf-21d249a9fac1", "comment": "Malware payload (DDoSAgent)", "value": "924b36d7208d07bfe22c63728bc6b2d88b7961578a7d5879f0226bf9e021052059178db733b868e78dccca0fa5f631ba", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224346, "uuid": "e7b0d641-3492-498c-9d14-ac956d89edc2", "value": "T166265B0DFE248F62C6A003764DB911882371AE026FC7471BA339F77CBDB6A88DD55691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224346, "uuid": "7403a8e1-f587-4caf-b549-ed866f329e0f", "value": "24576:wiFDuiOrnLaQG/e83uM8Hug7iTMTQFyrp83pP2qK4OWigSw92hdNoNaGG+k59yjJ:w4AaQa3UEylEBR92hn95Ed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224346, "uuid": "d17f4b8b-c92f-4a4e-a355-4963890ce7ad", "value": 4522132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224346, "uuid": "2f13fa62-310e-4083-a809-41fd30c6a4e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224346, "uuid": "d96539a6-368d-41b8-b01d-ecb11c549299", "value": "cfg80211d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6dfbf1d-8aca-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785273921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785273921, "uuid": "99d5a817-5983-41c7-92e1-22b50c343c64", "comment": "Malware payload (CoinMiner)", "value": "6f620f266c74d2bd871f50ea4b7fa2ee", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785273921, "uuid": "bc49a70f-18fd-4bc7-a643-1369f646ba22", "comment": "Malware payload (CoinMiner)", "value": "460210f3fd4047499e12f4e4fcbbf556f2a1957f1ef276238aaa152554a02b37", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785273921, "uuid": "94775971-9611-4d17-97df-c7d2d94926bb", "comment": "Malware payload (CoinMiner)", "value": "e8d952715fc718968bc810f43a683f3d56c7c3fd", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785273921, "uuid": "b3c59ca7-d625-4476-b95e-18690328fb5f", "comment": "Malware payload (CoinMiner)", "value": "b36aecdba23be659ee461a974abee86cf17487693e02792e68ed7d5a043df81cb8f7a674db90d484dc8da419f2d366a0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785273921, "uuid": "f0b27683-dbda-4c9a-8144-21f3fe486d0f", "value": "T1BA32900E2E470321EE5008B4F576464A542D1EE3B342FBEBE672E1DB4AD5E4584C1AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785273921, "uuid": "f6bb85f4-a5a1-430a-9050-b04e4f7f3e28", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785273921, "uuid": "3ed1b15b-cb68-4869-889a-67b6cbe0fb85", "value": "192:FoNSkS5B3lxSHO8K5hHPFJxTEZmFhqer:FoslsuPLPFwZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785273921, "uuid": "bf54510c-57bf-46b8-8a0c-908f465c50a4", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785273921, "uuid": "fbf0f07b-4429-479f-a060-88aa10a50788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785273921, "uuid": "5dd6d1aa-6868-444c-9377-c5e6b53e1c95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8169a1-8a49-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785218262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218262, "uuid": "fdd90244-5deb-40ae-8167-ae649b2f654d", "comment": "Malware payload", "value": "511e8e9c966d08db937385a34e9d3353", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218262, "uuid": "45095e3f-b8ca-4a9f-baa3-2d2ce936be0c", "comment": "Malware payload", "value": "46da4408acc3f285f0aaa6c1e020cf0179346d667f1baae32476df79a2de7263", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218262, "uuid": "b82e1efc-a295-4a73-8eed-ccdecc9f3ea7", "comment": "Malware payload", "value": "692d0190b184d050d69e27c2e3c6e6b192ec3890", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218262, "uuid": "9712a28d-bc17-448b-9819-47734fd1ed8b", "comment": "Malware payload", "value": "d86be8d11e12cd5d33396eb0508b23e555dfed70818ba446341d9f2625866132a9b02ae2c209d4958aa91895f499e8a6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785218262, "uuid": "ef359a88-488e-438d-a894-1568d04c6ceb", "value": "T181236C6616857C24AA98C4371D7E2F0CBDAD43E6320492EE7FCA3CF28C5A69DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785218262, "uuid": "a4fd0c66-b92a-4055-b2d1-6a2efc31dd3f", "value": "768:iXRWNGxVt9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:OlxQcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785218262, "uuid": "e9484f56-973c-43e4-8b68-1a2762ee565f", "value": 50039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785218262, "uuid": "e0bb3e43-c6fd-47a3-8ebf-ef0b69be466a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785218262, "uuid": "741819da-67fb-4a7a-85a9-efee008067ef", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5c358f-8ac1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785269822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269822, "uuid": "bd7692a6-022b-42e3-ac99-9b9c2cc16c65", "comment": "Malware payload", "value": "da8f88f7e94164bba3dd736ec9093a09", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269822, "uuid": "5710d318-9273-4663-8525-6f7aa0f9c89c", "comment": "Malware payload", "value": "46effa2a273d465e4a4bb96c0519ca0b5ac51ff141f8affcf9c9803c1689aa1e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269822, "uuid": "289e69cb-0d4e-4d06-bcfc-cf6173284e09", "comment": "Malware payload", "value": "c1acba9705f23da7f8b00a619db667100583692f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269822, "uuid": "9fa34f57-db5e-49de-b1b1-4470252926bf", "comment": "Malware payload", "value": "992c384329c3bb5ed4502ff8fe51d29ae9cfec60fac7bf964536557e8749799a3718dae10d267f15f4ab32eb82296e6e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785269822, "uuid": "152e2477-f518-4177-b488-b160c5dae8f0", "value": "T1F2235C6516857C24AE98C4361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A6ADD109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785269822, "uuid": "86a6aaac-9ca1-4734-89fd-40d8f8648c95", "value": "768:Bn+O9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:J+bcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785269822, "uuid": "07fbfd1b-e9cb-4db1-afdb-7fc5ef3fb72c", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785269822, "uuid": "f259aa24-e47e-435e-bba5-397eb3a77fee", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785269822, "uuid": "5ef7e1e7-ed2c-4bf2-81c2-d262831bb6b0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4934514f-8a56-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785223862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223862, "uuid": "9012b68d-d360-47b0-be32-4d49d694f741", "comment": "Malware payload", "value": "57a301321a2977ca4bf208ff4a8e138a", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223862, "uuid": "ba161e9a-f73c-4d20-a3fa-44fa62ebdef0", "comment": "Malware payload", "value": "4731fe8a99de186f488db56241373fe0207a8740f179016cad6c970c9943b748", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223862, "uuid": "f5949335-18e3-4e6b-bc01-fe529dc420ca", "comment": "Malware payload", "value": "8258fb2ff6c5a08109e8dc8565fc2389fecd8c86", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223862, "uuid": "18eb30a2-88c4-4406-800d-bee91b9099ba", "comment": "Malware payload", "value": "5ad4858166ec7e8e40b0f931842c9402209110fb5f7399b39f20838456452c6c693f0b54ee71d31b9c7ba6f81b03959a", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785223862, "uuid": "9f8b6408-f22f-4ddc-8f6f-602c951e175e", "value": "T1E0D4231179ED3D130C240E7A745F5B2A96731FCE44A5C16760AEB2C82F3F240AA7B532", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785223862, "uuid": "8be29329-03fa-441d-8a9a-e3e4358f0c21", "value": "12288:EzqKZQAr5vXiDuFhIsTLY2ZRcPcW109w+z4RSehvlrN1yeyJ/+C:HKZ5vyyFhIsTE2TcfO9w2gMLtz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785223862, "uuid": "bee8b654-18f6-4ceb-b078-0321c86f70db", "value": 600164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785223862, "uuid": "2aaa4108-e9b7-4761-9c4c-950597c37b87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785223862, "uuid": "de40c22d-ff03-441d-87fa-03f3d4a3c36c", "value": "reservphotoinstaynow.shop.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ee9474-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249709, "uuid": "52a7dff1-8d22-49ad-9345-04711a0682b4", "comment": "Malware payload (Mirai)", "value": "1c70c203e2a206f484944077f588b3f5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249709, "uuid": "449559c7-ffa0-4ba9-afaa-4570c99fcd4e", "comment": "Malware payload (Mirai)", "value": "4785789a6285884b546d2e9cb07cf6314dd8db261afdb1e33ab6216a36c43f0c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249709, "uuid": "dbfd3f46-de88-411d-bed3-0fbdd3d55d0a", "comment": "Malware payload (Mirai)", "value": "124e224e418b274f54e6f8d45bd0198b5ec6b3eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249709, "uuid": "1db1b76d-c92a-415f-b08d-da834f19726c", "comment": "Malware payload (Mirai)", "value": "419b17a40d5751862206f1a08c3365fa08c6085f8594aed97a3603277b7ff59807c9f2a2d0fe6a15a987a088cd4ac245", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249709, "uuid": "a8afd4a6-7074-4079-8b8f-c3e1dca93b6f", "value": "T1F333F160AC020930DF254C3C9B794C46AF487E76C3FF990210B554BEADE694A6FFD48A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249709, "uuid": "8658079f-c81a-4dba-839c-3327639f38e5", "value": "768:A4bghuaxMpS5QrHQ92DzD25rwoaO/q0KPEpECVB+6098zjEtyZ/c2emkM/BU9q3F:Xggaq5ccK5r5vCMpvJOUEtuOEB9LL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249709, "uuid": "96983890-bcb0-4dca-bf9e-134635046993", "value": 50264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249709, "uuid": "4d0d0f66-986b-4964-ba9c-818023edaa71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249709, "uuid": "32f90d25-8202-49a0-8350-385405fbbfd1", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a61995-8a96-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785251342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251342, "uuid": "1982ecec-bb39-40bf-bfad-fa2cf61dcbf5", "comment": "Malware payload (Mirai)", "value": "ed31f62261d1aeed15bee7b724e99b1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251342, "uuid": "463fbd40-ba18-4e33-a2b4-1bf9eaf2a0ac", "comment": "Malware payload (Mirai)", "value": "4790c081099c7c17b2bc1e9dc0f35fa3b2b036b2ce4a2b4044e94486ba807b1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251342, "uuid": "df791396-2166-4bb2-9d33-ff061f6e72f3", "comment": "Malware payload (Mirai)", "value": "2bea4afb18b6c43f9916af9bbc4e615b1358771e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251342, "uuid": "5ae018c8-2036-4768-89ad-e648c9b5c4dd", "comment": "Malware payload (Mirai)", "value": "01bf42eba8be649ea98c26d644bc04e7e9c56bbfde8896062b5f16921f833e4075e3258dda777e37ffa6190966e31b65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251342, "uuid": "cc844948-a29e-49df-8fb0-a544c009573b", "value": "T1D714965E6E228F7DF368C73447B34A34976D22D627E1D684E2ACD1141F2424E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251342, "uuid": "a589ae26-4e56-4f7c-8bdb-adb896b3e6cc", "value": "3072:dwp4DOjU7q9wA2NXBBFbYdBFun1+rbtuH2yoeUfJxJ19s:dbDOjU7qf27zUnqIrbC4eUfl1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785251342, "uuid": "27508ce8-318c-4975-a950-45cdc809e187", "value": 206652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785251342, "uuid": "7db96355-b99a-4914-94d5-42f7eacb9593", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251342, "uuid": "879ec3cc-ef6a-4751-b37c-45f7adcb3eed", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae63c187-8ab8-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785266122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785266122, "uuid": "bb8ca81b-5cda-43b3-b6ad-0dd60187ce4e", "comment": "Malware payload (WannaCry)", "value": "700fb7e2c6a2ff13cd27e08a18703423", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785266122, "uuid": "b6a10a02-7788-41fa-891e-bc3c1a9c4ce3", "comment": "Malware payload (WannaCry)", "value": "47f9779b48eeda53a846a2460456c738ad752ad0e02483231d927930f3f37dce", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785266122, "uuid": "d2508784-0f75-4138-89dc-a21816bd6fea", "comment": "Malware payload (WannaCry)", "value": "19cdc7a8624c614cb8c06dc4f439fe86f9e6a515", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785266122, "uuid": "24c9e326-3da7-4be1-afc9-e29b37c364d4", "comment": "Malware payload (WannaCry)", "value": "8662cc61f7a1bdd5e118a3c4a2a31397253e3639739bf82e14d87fe05f10dcfc7fe3f4d08abc60319d5825a81be2f2d4", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785266122, "uuid": "d35374c6-137a-40b6-9b23-bc3aaa565040", "value": "T14336239631FC80B8D206157484F79E12F3B2BC6922BA6A4F9F8049752E23B57F724753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785266122, "uuid": "f1fee23e-3af9-4093-8b00-687bd0c13d5f", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785266122, "uuid": "7d23d9bb-cdfe-4c58-8162-58ffb238e4ad", "value": "49152:jnsnRMSPbcBVQejduNRx+TSqTdX1HkQo6SAARdhnv:DMRPoBhpcRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785266122, "uuid": "0b6408c1-e3e5-450d-84d2-7c4331d94178", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785266122, "uuid": "2fee93cb-9f0e-4877-8036-37e1080677f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785266122, "uuid": "590a8dcf-07d2-42f7-bcae-011ee9cfca9e", "value": "47f9779b48eeda53a846a2460456c738ad752ad0e02483231d927930f3f37dce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3678dc6-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221087, "uuid": "db382d0e-0d95-4a89-8f5e-b75650ce0ce5", "comment": "Malware payload", "value": "25524f2b5833b9c9749b1b2a4901f032", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221087, "uuid": "2324a9f2-4270-4be8-bcc9-9e60c7ee03d7", "comment": "Malware payload", "value": "48b6c91da508826cc9649802aebf5fc9bf47258dd0f4fa461638a0ad09637f99", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221087, "uuid": "a41abff3-0086-4722-b786-37f03d53d18f", "comment": "Malware payload", "value": "3648004986c33866233ce7a8ffa373188f8008a1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221087, "uuid": "570a79f5-97a1-4ce8-a861-a8d09141e322", "comment": "Malware payload", "value": "489e49a82da08f4fae22d76af1a2c0516db9d5d5d6b44e21e0fcbd10a6ba250cbaba4c56fd76069809d4c2757dfc374e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221087, "uuid": "44323ed1-9260-4946-8686-756c06c5b630", "value": "T1D072D11B9B32F393E919BBFF25DC7560116F58CF0602920A609B96594E3C5FC456B818", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221087, "uuid": "5e0cf1fe-ec96-448b-b99f-0f5f2f82c83d", "value": "384:OCCh066NfS6Snds8Vn6KH27t0iC2osU/OIDPnIPvXV/:OCcBYfbSn1nd2CiDU/JoXV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221087, "uuid": "0cb1b4a0-25c0-4b65-8f13-a90d487dafff", "value": 16281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221087, "uuid": "30687b3f-8a01-4645-9ea0-e66e1542d004", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221087, "uuid": "715a7d2e-1052-44d2-b182-d2b540d81634", "value": "images_20260727_174757.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd5f256-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221028, "uuid": "2c6f09ea-6dda-4977-a236-42d4caea2520", "comment": "Malware payload", "value": "d0ba54c9bc69fe4bb18bd99b8d160472", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221028, "uuid": "dff17b42-85c5-42da-af06-f19bc985d41b", "comment": "Malware payload", "value": "48ef91044cab35bbecf4b7e920943ebd8a23c1103024c41a8b6bd2ab4b0d8053", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221028, "uuid": "7ac65063-e146-4b18-b72f-27954672f9b6", "comment": "Malware payload", "value": "4ca7fb26b1e621c3c68e10eca9fbe237f2cbb97c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221028, "uuid": "48032ee4-205d-427b-95b8-d20a073b462a", "comment": "Malware payload", "value": "3be9e6c9cb83d6b0e2cba8bc12205f149b1ee4277ebd1cf4b7b2c4f5c72f7f661a0d3736f77ba663ab8bdc217ce70859", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221028, "uuid": "10686701-8644-42a2-b6b0-f87ad084fb66", "value": "T131F19EE6CD2E3DCFA9059E76DD985824121D2DD66D67B314522CF6E928038A021CB0C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221028, "uuid": "2f0b34cc-d089-4d51-9840-db4f61ae6db9", "value": "192:Enavn5hjdIPnedZANkSskYSAZ2Q4Mg+T2ce+:sCnHdEnedZKknSAZh4MEce+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221028, "uuid": "d66b136a-6c86-4e6f-bf8a-7d9986a885e9", "value": 8075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221028, "uuid": "b45148c5-070b-44ba-afc4-6200e33fbe81", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221028, "uuid": "a11fce54-31aa-4f19-aed6-5ea47c9c8231", "value": "images_20260728_011857.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a9863d-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785224556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224556, "uuid": "b3d6b7d5-38d4-4a37-916f-c2e7b89c9d33", "comment": "Malware payload", "value": "5fa693aad94069d036c7b381e077f4a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224556, "uuid": "309b6cf5-a36c-44c6-8f81-8a72dad9cca0", "comment": "Malware payload", "value": "49886b11ba85aef3f41d4a1e94cd9056ea12e927a47ef1853c7449028dcba22e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224556, "uuid": "0ded9ca6-f101-42e8-bd67-e71b90112e54", "comment": "Malware payload", "value": "3d9f4addf09f3eaf93252a3bcd124062435d4101", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224556, "uuid": "dd32f7e0-8314-4ca9-a530-87914e789aba", "comment": "Malware payload", "value": "79d5d2c5f82e09a89542b0f0ebd6674ef3fcff9e16945d5f92968e33e09360ce6450bb9a6997756a7fd63283bfa06a33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224556, "uuid": "80f39c9c-b9d6-4b21-9bb5-d788de2e3d05", "value": "T11E264B06F6046F99C964493385B74EA037726D856B319743E704F3BEA9B330A4F26F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224556, "uuid": "865dc770-b192-43e2-a282-41426ec39b1a", "value": "49152:V/s7P5Llddc2ET1OStSJ6TWU3aR9Kf35EV:h8P5LHdc3T1OPWBEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224556, "uuid": "35e75627-06cf-4103-97de-55a0009f813d", "value": 4587668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224556, "uuid": "693f6330-8ff3-492f-bb4d-bb0a315b38fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224556, "uuid": "5af405bc-676d-4761-bcb1-c1d7169f4620", "value": "zswap_shrinkd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d311ec0-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233237, "uuid": "9b5e0bce-d300-4b3e-8b30-136a07a3a33b", "comment": "Malware payload", "value": "dc4d962b312a55162ff130e222b9ab1f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233237, "uuid": "b11b9d3d-40e6-4610-814a-221882b18b8c", "comment": "Malware payload", "value": "4a0c77e8d240cebd1d8bbabd14f8a815d35d561cc037f94d9c3acb9da21c41e3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233237, "uuid": "e64fa6c8-597c-4f4d-a737-f3e997a53b26", "comment": "Malware payload", "value": "4840f5f2d98c91c7288a8be4c2876ab7d9fbfc73", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233237, "uuid": "c47e665d-3e5a-4d4d-8188-97b7188f62dc", "comment": "Malware payload", "value": "a995485d3b4bc569f0d0e265ebdfa651d380171a60fb063d0ec44431358aa2fa757f7e27364b265879ad84cac5b31536", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233237, "uuid": "be702e53-7af0-4f77-9973-30b35ea68b7a", "value": "T10B42B020EF47F931E6E5457104F6786CBA0593B6DD82EA5E8167560CE3B04FB15CA83C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233237, "uuid": "cef86577-a274-454e-8598-1bc9a86a30d9", "value": "192:puSUpExoTlUReiW47X8Lv4n+Ec/Rty21f8UYKCWvrh8YMtQ0ttT5r+:pulpz+hr8LvZRUUYnCAp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233237, "uuid": "7f258f3f-5001-48dd-84e8-4a0e1a5bdb35", "value": 12314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233237, "uuid": "efcaa998-12ed-4ba3-9ea6-9d58d2cce47e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233237, "uuid": "06af9206-92d4-4d0b-b846-0da56cd934db", "value": "images_20260728_041926.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef23805-8a21-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785201269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201269, "uuid": "e7e89ca1-fb3b-4bbf-8d27-5b3108cb8a35", "comment": "Malware payload (Phorpiex)", "value": "eb80b24437ca144ae6cf0b19a03ca599", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201269, "uuid": "b87918e3-9a2b-487c-8c66-14020d877166", "comment": "Malware payload (Phorpiex)", "value": "4a319c860dacdd7ff95772e04b7072bba01e43d9f9d03a3cc3ece1e7064e071b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201269, "uuid": "7371691f-dd8b-4f3d-93f3-baa34fb454ab", "comment": "Malware payload (Phorpiex)", "value": "57d1464da3f19688610c9526b6dcac48760aeb78", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201269, "uuid": "ea54e599-eafb-42bd-9012-10b25ba65122", "comment": "Malware payload (Phorpiex)", "value": "421daee17186030d59159839b2b026f20da8cf09ae62c79a09995b5bed777a32172c56b5003355343465a29300ff24c1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201269, "uuid": "85fd0bde-7f51-443b-aeaf-55a96b55c98e", "value": "T159623A0AB4818035EAE14075827F526649BEADB623C4F9D7F7E0A8C94DB4BD1F4311AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201269, "uuid": "ef2ee6d1-8dff-4c5b-ad5c-7bb1eb1c2ab1", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201269, "uuid": "25fa01c6-6323-4f23-a083-9fdb797ec5a3", "value": "192:AWTsGnjXgjk8LcRI+Q1RDMlYfV/F5oIVUBKUSftzQFBrfgJxTmv8U9cth29ik:AuScCtfV/ro6toB0av8U9coX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785201269, "uuid": "24488213-d4e1-4b71-9a9a-97e5c4f944b9", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785201269, "uuid": "aa513012-16f0-4154-98f9-d3a22c434728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201269, "uuid": "9a3ecf92-8ca9-47da-88c2-0a4c8cbff9da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7998a051-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785211058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211058, "uuid": "bde56256-16d8-46c6-af6c-837304003be4", "comment": "Malware payload", "value": "c6cd1b09bcd72c3f0c09e1cd70cb4cac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211058, "uuid": "59584a43-182b-471f-b8f9-28a61efc756d", "comment": "Malware payload", "value": "4a4756ccfeaf14d0642b7a3c510e5dd4c5ec88bae2645b9f7a6731e5dab4ee73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211058, "uuid": "b6ce863e-e034-4ffe-94c1-de016336ee1b", "comment": "Malware payload", "value": "f255694e4d3cf488caf35d4b779d84f4436dd541", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211058, "uuid": "916d35ec-8b81-4f8a-8311-2e0ca242e31d", "comment": "Malware payload", "value": "3a437428e13f391902f8c1e776e7d99e2c2f5255531884faa5b2726fea3ea364f9e3dff11e2bb2301795e76d31926d0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211058, "uuid": "f43e595d-809e-4fd0-8819-d9792fb89710", "value": "T19FE45C06BF915FE7C45FCE30496EC30701E9D88796D2622A72BC4A4CBE9D35A0BD7588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211058, "uuid": "73fec6d1-6d7f-4378-a459-b56183fc031a", "value": "12288:H4bOa2Cx2F7ab13rzjmhhfd9tMYCPsPDmvxrzjG9GovlZ6klCaZvR9e8sncIp78M:sDWab1bofW9ivLem8ZKZOiDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211058, "uuid": "cfaea132-8b62-4635-a45b-f3a1cd3f557d", "value": 677848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211058, "uuid": "62287bba-04e0-4354-b314-c93c8cc2b306", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211058, "uuid": "6b2bf73b-d136-4b10-bd8b-111be4c11bf8", "value": "test_mipsel_26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d27855-8a55-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785223526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223526, "uuid": "3650efa9-8742-432d-841a-8ca1418b05c4", "comment": "Malware payload", "value": "484d3ee3dd95da96d61e7ef560dbeb04", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223526, "uuid": "3f3d2d3e-89b6-45a9-84af-983c62ee5617", "comment": "Malware payload", "value": "4a62e3ff4348134e74b15323487e38a61ff4ad7290d39844d0d9508589321a08", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223526, "uuid": "10ab2bae-5e35-4576-8f4a-bb0a8ec862a3", "comment": "Malware payload", "value": "add3e10f2c15c085a9556f75e12223252a67c8bb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223526, "uuid": "834be64a-cb4c-43a2-84a3-224588594213", "comment": "Malware payload", "value": "a3fe8849bc2f1f359fc47654266e4fd82d33a6e69991e7f360208a5d2234d6a581862185de50dd0f2c1003031d561ba1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785223526, "uuid": "87aa07b3-63c1-4947-8829-6723da892a88", "value": "T16AC27D956A86BC44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785223526, "uuid": "03620331-ebdf-455f-9d78-077f75e521e6", "value": "768:s8vCB+25j6es8Rb9FYpMSUpi+20qUpi+20YQX:s8l25Jtd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785223526, "uuid": "35da508b-3b6e-4245-ac2a-d560281cefb1", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785223526, "uuid": "f5e6c146-0760-4039-892f-fbec9cbc194a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785223526, "uuid": "02970235-a17a-46e8-8cd6-4e4258868a0a", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea4df3b-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785211040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211040, "uuid": "49539bed-2966-4056-99e7-2f36badc14f6", "comment": "Malware payload", "value": "a53264f251fbca4ad3b7b10b81ec82c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211040, "uuid": "cff659fd-8cd9-43bf-bd56-a98fc1d62862", "comment": "Malware payload", "value": "4a9242fd29f97adc31527b7ce316b9f37876cece9913ca280fd165ead5c3458b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211040, "uuid": "3b063197-f908-41c0-b963-3de402e5e995", "comment": "Malware payload", "value": "f1ba13be1f7cbdb7aa18c365ac6d05a8acf01189", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211040, "uuid": "730c9710-c76d-4889-b2a4-e990c3699f2f", "comment": "Malware payload", "value": "0e9cdc8af8128e616bccece81561af4fc7670ea4d83dfdc0db18e421b45c530429160a107c688a0b222f15fa5fcaf9a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211040, "uuid": "6b06efe2-5919-4bf9-bca5-10b51227fdb2", "value": "T157311FCBEBA18FE7DE4C873184FF4B0233A3D5914542C71F061095A42DCD2902D22D11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211040, "uuid": "edf15fb7-790d-4976-9908-60cd68d1bc65", "value": "24:3Hs+UAjSsFkH66sA5lZifbyx+mWqQdrzvA:c+UA1FkHjFcV7rbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211040, "uuid": "9f04e757-860e-4471-aa66-b05fcbdcff62", "value": 1672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211040, "uuid": "e70a029d-ef93-46cb-9cf0-95cd90c65a77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211040, "uuid": "fcb99aea-8b99-4684-a00e-1168a642ccee", "value": "rawbot_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf37197-8a74-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785236996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236996, "uuid": "78afb99a-c23d-46bc-95be-7a27c67578f4", "comment": "Malware payload (PhantomStealer)", "value": "b7d0d5b53bc08fb2d32ba33252584936", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236996, "uuid": "cb7233b1-3ee0-4f5a-af67-26d6f9281927", "comment": "Malware payload (PhantomStealer)", "value": "4bc1a57aa178ec0dac3e9cd8588be8262215dcc2530631ceffbfb3ace6a5e7bc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236996, "uuid": "63f78e1e-1fee-4b2e-a38b-acdc4acaf5f5", "comment": "Malware payload (PhantomStealer)", "value": "f55e1908febfa7280376e44a1163570287ea5863", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236996, "uuid": "1770bd9e-0b75-4657-b366-593991306108", "comment": "Malware payload (PhantomStealer)", "value": "baf138e3a8e0a54515200c7935689a2ab777f0aa440edb597830fe075cd60b9ae61a5b2e6f38f1ff366a59e6f3675209", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236996, "uuid": "8048eb2b-1ec5-4fc3-b026-d7c2f5ca2af6", "value": "T1742420610887745063377BAFA326A8A1E3620B7B06982D177CBC7840EFF2D16D9E4D75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236996, "uuid": "3434b5f5-c301-4cd0-a5df-d22706258abf", "value": "1536:g9HKl5ZfYdRa6u3LNvUFhGPfweV4OqJM40adGsvOKueIjFGiolTkY:Wa0gLNvUHIvuOqJDGKHIUJkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785236996, "uuid": "b4be61d4-8fd4-4b64-a6f9-f7d3100d0fef", "value": 212657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785236996, "uuid": "9fd65aec-ae8d-4568-91ed-4f579356d731", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236996, "uuid": "bde5be0f-a570-4d63-8ded-74cae70ea7a1", "value": "Order-MH-ref287262.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daacab56-8ac0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785269633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269633, "uuid": "14e19fe5-1475-4de8-aa15-bd97996e76e9", "comment": "Malware payload (Mirai)", "value": "90889c8219f16e46b4fd3d6f4f6e9a7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269633, "uuid": "39867eca-a50a-4449-932f-c0356a536989", "comment": "Malware payload (Mirai)", "value": "4be16b2978b746c0eb0533f91a5de765f783ccd1bfd914deb921e90d7301d2ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269633, "uuid": "4e2d610e-d69b-4ad0-b5e0-f65ef2d171fb", "comment": "Malware payload (Mirai)", "value": "8a1b05490faf66c97f18793ba48dbce2e2b1886b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269633, "uuid": "0e0d8085-e249-498d-ba74-d7789ef2f151", "comment": "Malware payload (Mirai)", "value": "b2c34360f18ee4d08fff9b096939bbfaffa7c624cb6527321930f5cd56647515fba3c72be8f0833ebba4287a5cb1d7f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785269633, "uuid": "bdc8f5ef-527d-4065-9483-2837ef0e1337", "value": "T187932A03B58090FCC5C6C1344B7FA636EA72F1ED1275B69A37E4EF222D4AE211E2D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785269633, "uuid": "bda8a5a3-6ca1-4564-a151-98557eeecaa4", "value": "1536:KPvjFFjrKGGg17rsyCcpUu1v/43WL4vwi252xPSUUN4J+LDR:KvjLrKGG4syfImLviNxpUN48LD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785269633, "uuid": "a744f68d-377d-4e7d-b72b-ee5371ffb8b5", "value": 89232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785269633, "uuid": "e24f5f44-e060-4c7a-9cf7-a92a1b68f0b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785269633, "uuid": "1f943510-3678-4edf-b682-b10e3e112764", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ac7de4-8a8a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785246319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246319, "uuid": "202b5814-b39a-455a-9933-c7ce331695cb", "comment": "Malware payload", "value": "7f841b8db89f171392fb6b735345ab57", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246319, "uuid": "1f09f923-77da-40e8-a29b-9fc0e38762f3", "comment": "Malware payload", "value": "4c093033413b4e878b2e1dd73ccdd098652d2aa99b06818630d2107b0f2ddfd3", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246319, "uuid": "923f9748-c622-4185-b191-4efa78e6ecc4", "comment": "Malware payload", "value": "2dc3ee5665e15ae4aa9fb279b1b45a300fb3dc3d", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246319, "uuid": "ca2739c1-68c9-4de4-a2c3-953ad279115a", "comment": "Malware payload", "value": "ed0fcd513cea1cb7614b0649b4d5364b241f2bf727ad03a1aba3f516153c21a055d3314d6fdbd561c797acfaf389f304", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246319, "uuid": "1f5ffd1b-ca3b-417c-a78c-04cbf8b1cdaf", "value": "T10DD5DF25E3D901A8E577DB38CB629333D6B1B8461321E59F0699D7152F33E909B3B322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246319, "uuid": "86032958-7e07-4069-8f9e-1a92f9ccbf6d", "value": "22db4279351881cc876b9d7a5b04df90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246319, "uuid": "b2db29f2-c1d4-47bf-882e-7a0c8fc4042b", "value": "49152:29Xb1IAZ1nrfxifaT34KWiXZQRIvV1zMGPwT4P91Pae:sl5LdZ4X4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785246319, "uuid": "1b7b7205-451c-4349-a762-41b3c625367d", "value": 2805760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785246319, "uuid": "ff937d3a-4997-4c9e-a50f-dc7266bcaf8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246319, "uuid": "0ea8de08-60dd-4df3-a3c5-2c3a42005269", "value": "jli.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c394c9f2-8a39-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785211612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211612, "uuid": "e49b7072-327c-497a-bef6-84d828669692", "comment": "Malware payload (PureLogsStealer)", "value": "ad237788506280e8b33b2d49785e1fd4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211612, "uuid": "5800fd6a-6ec8-4934-886d-910560049de0", "comment": "Malware payload (PureLogsStealer)", "value": "4c5fc1896f633b28f6a102c6cf0e83cce39be8ede9e4b0f91f5ef9c42e6ab7c5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211612, "uuid": "a2ea9ed2-595d-44f9-9d01-b3ba9404bc87", "comment": "Malware payload (PureLogsStealer)", "value": "7352ba07f683590fbf7e905e7f80247c979cc9cc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211612, "uuid": "828eaae1-9f61-4347-9feb-726736eb6eb5", "comment": "Malware payload (PureLogsStealer)", "value": "250797c3e2f6f910eaa02214eddb4d49bcaaeea5ac5aab9022f6d9002e03306a2313a0034c84710bdef3bb1b02643b97", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211612, "uuid": "f748dcb4-677c-476b-bccf-4c801d01d1ed", "value": "T19745E83DCDE8412FC1BBD529CA8A4A07F84E496B231DED0A74D373DB55261C2BCA215E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211612, "uuid": "57041515-a6f6-4cd2-aa68-2550c189897c", "value": "3072:J6UPQ3iiy5ELEpciF0mo8KQdGIVIibNhV1kdmyFBgoX7eU1TzsryrbTAqZ5ZPAmW:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211612, "uuid": "f0135d8d-03ec-475b-a38b-5699ee8bae4d", "value": 1178112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211612, "uuid": "009640aa-ed00-4774-b11e-a0c884e42e14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211612, "uuid": "40231873-f75f-45f5-bb31-fc4b222384ee", "value": "Requisition_2026_Order_Confirmed.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f3f762-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233270, "uuid": "67484a0b-f2d6-47a3-a789-63c4c6467759", "comment": "Malware payload", "value": "cbb40a56a15b93fc2dde645a75dcd827", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233270, "uuid": "69f9edc4-e075-4c1e-a2b8-b5c6c9059ac9", "comment": "Malware payload", "value": "4dfe2b09c6959f01eb1b181cb41242d7ea1508bf8b0d5a3bdfca4b9a40fb21f4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233270, "uuid": "2e43afd2-0b02-4160-a9f8-dfabc6a5865b", "comment": "Malware payload", "value": "6f85b3586e60dc435682fddd75d7bf1961d94f4f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233270, "uuid": "ec1c109a-cbc1-42f2-abf0-bb1f6abd10ce", "comment": "Malware payload", "value": "fe290a520f02cbea92942feb9ce740cd5a2ea30df20134d56934be867545871a4e407b1b94f7c9596835745e2606a751", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233270, "uuid": "c9520776-afc0-45d6-80f2-22ba936e647b", "value": "T123412C1B0B4780A3C2D6F9BF8C5209A9A55DD4F32943154F77CAD2BE85D3423B61D54C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233270, "uuid": "69acd02e-79da-4f73-b115-7698ee1a29c6", "value": "48:9kG/aBdwoYKl7ari93ctQP5DWS3BRH/uoUHnYukGzy6ibjM4vRsowj:PCjbJQitctgDWsKYuk7HM4vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233270, "uuid": "c116f647-7635-4966-9dca-4ac124ff6411", "value": 2097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233270, "uuid": "0d5de04a-36eb-48a5-b0b5-8f4196c3b7a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233270, "uuid": "d5d54454-1b06-4ed8-b3bc-cc81b67d3d53", "value": "images_20260728_092745.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f34bb1-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785245645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245645, "uuid": "2d524478-b9ba-4240-859e-960a8d3a6798", "comment": "Malware payload (PureLogsStealer)", "value": "65ee6b42c5babfa8327fa896df54c007", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245645, "uuid": "2421692b-5fbd-4a81-9b4f-de3c07884744", "comment": "Malware payload (PureLogsStealer)", "value": "4eac222c9b28ad1fcb44fe3a15a228632cce94333d6ca132f8e156d09adb8677", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245645, "uuid": "a921e5b2-103b-4214-8715-381d2a07ae03", "comment": "Malware payload (PureLogsStealer)", "value": "a4394d5131459af0cc20c19fde8565d8eecccb77", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245645, "uuid": "98f53d5b-9821-4cff-85f8-4b2b2ea274b5", "comment": "Malware payload (PureLogsStealer)", "value": "9279884113ceb8fefe4fd714639f9449ef2a49e87a483f3a6fff6340482c5d3b2bf34786a2a92a7dc1829161a5a820fe", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245645, "uuid": "a135b4b3-4374-4a21-930d-3be27fe3837c", "value": "T1C306CF46B3C86AEDC016DE399714F232C1B2BD238B76D0CA5E96C70A5E76D514F3AB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245645, "uuid": "55ff1d4e-2085-4116-94b3-bf51e2f0d105", "value": "46d844d880996af2766416e3e2079244", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245645, "uuid": "cde76aed-eb4e-4a73-a0bb-1efcae0f7b77", "value": "98304:lnsDCZ03nkfcFyRLRWRGSp218eXDeLigfB8l7VG0cmyt5yxJi1y8sFWf3V6TaNSv:6VfqLMLpaXpKKl5ldC8SFEalQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245645, "uuid": "76fb01e1-d782-4761-b60b-5cf4fcb6eddd", "value": 3771392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245645, "uuid": "f0583190-95cf-451a-9650-f9eb26ac1e58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245645, "uuid": "8d2394b7-c987-4d52-8a7f-e913930d2191", "value": "4eac222c9b28ad1fcb44fe3a15a228632cce94333d6ca132f8e156d09adb8677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25a243d-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249781, "uuid": "f7e6e739-53b8-45ba-ae08-9aee649224cd", "comment": "Malware payload (Mirai)", "value": "3ee29ac65494ad9f268807b0f039209b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249781, "uuid": "f3f792d6-e011-4248-8e15-5fb4e33c4fbc", "comment": "Malware payload (Mirai)", "value": "4eb0fb015a24233010954143007cf4b44aeb93f382feb0682450accc0b5b8272", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249781, "uuid": "14b289b9-be9d-4ce5-ba28-dbad555a9bc5", "comment": "Malware payload (Mirai)", "value": "649adcb1ee08f2a0f4cf61d6ee4c6ba49e1a1d75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249781, "uuid": "d3f4e525-d8d4-4f11-a9f4-43d61a10f507", "comment": "Malware payload (Mirai)", "value": "9c14374e9ba1f487d17e83b36f786c6f627c79c9265c3b10d5b51c88364e3393a94958dbdb697f41929ce78768afbc41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249781, "uuid": "62eb1c26-c018-4aa6-a754-599950bd5f95", "value": "T162F33D85BC848B12CAE151B7FB4E528D372643ECD3EAB1039D196F25379B8970E37612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249781, "uuid": "5e0731b1-f2f0-4ac3-80fa-681e5e3c29a0", "value": "3072:hi9fiqYv2GPiG0s3LRa554pLOn7wkp7P9x8:hi9KqE0s7Y554pCn7wkRVx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249781, "uuid": "c618207f-2d46-4d93-8322-f5db198c0531", "value": 163360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249781, "uuid": "cb5d473f-aa37-4f42-b103-a53a9e249407", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249781, "uuid": "7bdd5ec4-1d32-40a2-aa73-6e740ff65a2d", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1949b0de-8a79-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785238814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785238814, "uuid": "1dbd4d7b-14b7-4134-9b56-16487b595022", "comment": "Malware payload (Stealc)", "value": "929f05e274f24763222f9649eb3b14f4", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785238814, "uuid": "262b05e4-fa9f-486a-9372-524b54976701", "comment": "Malware payload (Stealc)", "value": "4ed3931ab5bddd24ce23fd0d5546ae45b52a0cd0124afe7cb3692a56510ac1ed", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785238814, "uuid": "af4dc99b-6c7a-49db-96ff-5031dd8d53e0", "comment": "Malware payload (Stealc)", "value": "0ac94a08e0cd2886f69296193548b348dad0ff26", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785238814, "uuid": "84b99720-09b7-45ff-bb99-57aa34613e1f", "comment": "Malware payload (Stealc)", "value": "93012edfbb8116e3f4049737877a28ca21d7f630aca0ef5eb3e215a71596e7b3764a227773cd5097e2c9ec14386c0bf3", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785238814, "uuid": "2938e72e-530a-4044-b628-8da733dcce1b", "value": "T12D058D1AF3A502F9D17BC178C9424552EB72B8565330AADF03E14A6A1F376E05F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785238814, "uuid": "3f1adabc-38c0-471e-83fd-d598c2a404c8", "value": "e9dd64dcce15e249bad873d9dec07f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785238814, "uuid": "3a13e58d-bd98-4379-b74c-ce591c5e19e5", "value": "12288:ZngwZs/X8eipbJVfMxBkfCTE+HCTMTkyxBlDetAqxSvoD:ZgwaMeipbfCkKTEGmM4yb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785238814, "uuid": "4240e693-c94c-4936-9118-ca0e8e50de77", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785238814, "uuid": "2aedb617-ff2a-4fc2-b916-8b8525c90414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785238814, "uuid": "fe371ee5-d5a0-4cb0-a3ca-e215429e85cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0004010b-8ac9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785273131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785273131, "uuid": "ef23782a-96cb-4e44-90e8-9d56d4f08a15", "comment": "Malware payload", "value": "561b4d321e756c05752571b54bce8a65", "object_relation": "md5", "Tag": [ { "name": "AshenLoader", "colour": "#9455C2", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785273131, "uuid": "27808cf1-f3c4-429f-b647-44be8b5a4524", "comment": "Malware payload", "value": "4fc548d4267d30acd658a3a43e30b4924dade9371cf6448cb1ae9e374f7dd69a", "object_relation": "sha256", "Tag": [ { "name": "AshenLoader", "colour": "#9455C2", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785273131, "uuid": "fc45520d-5703-459b-b9f5-f461f31ca190", "comment": "Malware payload", "value": "d9f554eb2d81ab6293235c42e19d4113f91b7725", "object_relation": "sha1", "Tag": [ { "name": "AshenLoader", "colour": "#9455C2", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785273131, "uuid": "f1c97d4b-f482-40de-abaa-0f9805208763", "comment": "Malware payload", "value": "1f29bb381dad26e714d6e22f6290220211e9c3119d09818861e5be59d22f7366a44f5b891853e15eca61cfada47a81a3", "object_relation": "sha3-384", "Tag": [ { "name": "AshenLoader", "colour": "#9455C2", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785273131, "uuid": "4ae8948a-6d47-4398-ac97-33505cdfb8e8", "value": "T1E2542B71B0C4589DE8C9C97C44E9760A0B3D7D1F8AE928AB371CEE25A7043C1BF15A67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785273131, "uuid": "66a47af6-7cbf-4dae-8e35-d0eebca94242", "value": "6144:oNJX3NAbLf8KTloA8rEQ4FLyj2Un161ajwC+57v5:oN28KlFLM16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785273131, "uuid": "913cc560-49ed-4488-8b13-f4c15119531f", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785273131, "uuid": "3174d262-7283-47b3-90e1-2f2d9b187984", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785273131, "uuid": "519f61ae-06b4-4e6a-885e-001b330b30c6", "value": "communigatepro.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a33063b-8a48-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785217958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217958, "uuid": "8cf8e890-bdbf-448e-b586-0aa80da575d3", "comment": "Malware payload (RemusStealer)", "value": "4200fbf91504f5a9e545fbd6aa9b1ec4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217958, "uuid": "709f1931-3bcf-4e6f-a902-7687a97731b6", "comment": "Malware payload (RemusStealer)", "value": "5043c52418d1e8c7e0ef50572965de2900e4bb092c88d15f6cbebe45f830bdc8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217958, "uuid": "f5439dca-6205-4ab3-b597-8d55ac4d1248", "comment": "Malware payload (RemusStealer)", "value": "e36fc689c034f55361f9e5e61eca67434411cdc4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217958, "uuid": "b15013f8-c189-4e50-ba3c-8a285f86091f", "comment": "Malware payload (RemusStealer)", "value": "00321cb1fb03057eb925e3b8720563e3a41815e8370bc9eff4b1a2df1b97077feacfed61a89201cd16b68c8ee0768129", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217958, "uuid": "cfc76ca0-0edc-4662-9998-e41299694e78", "value": "T1CEC55A077DE149E9C0AE933188A652927B75BC084B3673D72E90BA783F727D09D36B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217958, "uuid": "f9c8dc5c-757a-44a2-b0fc-bb903e0b435d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217958, "uuid": "49acd227-6411-4445-bb4d-fba194d5cde8", "value": "24576:koo9Jm21vQ8NhpLXKXlZWd6ptWpKWIj2XxZv/rbK2pMVNtxJBele5r9D077MWJYa:komd1Q8pL6VZW8op5Xh5bKMMVhesyem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785217958, "uuid": "8f9987f2-09dd-45f5-b944-0c57c6f8848a", "value": 2532200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785217958, "uuid": "56e7f831-b926-4de7-879e-e76b7f1d3ab3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217958, "uuid": "6b52211e-66a0-46df-bb35-14d1678351db", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6501464-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249788, "uuid": "ff8291de-e527-4fe9-9d2f-41ba3815e5f9", "comment": "Malware payload (Mirai)", "value": "d91dbc9cdf6906bee8964f87d9969cfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249788, "uuid": "f433db62-d300-4e5f-a0b4-7e489ff62285", "comment": "Malware payload (Mirai)", "value": "509e79f5a89d66798c2e1ea72981f2fde1c1c46ef3fb34947e7ee1b99239134b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249788, "uuid": "9799f104-d022-4dbb-9969-4843aa2f8ae5", "comment": "Malware payload (Mirai)", "value": "497eb757606ae522af0b9a879ae622750f91aacf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249788, "uuid": "18c09099-7dad-46ac-bc25-378ac08a25e3", "comment": "Malware payload (Mirai)", "value": "d45ac9e876257a853217df1f9b5c015644b0c62f175d0d45afd6454c27f6ba82e5a17e438318e9b86606ea2d7df4dde5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249788, "uuid": "01a1a578-34a8-4b48-b09b-3d93c93a825f", "value": "T139041A85BC818B01D5C116B6FE1E164E37135B7CE2EA72039E186B3D778ACAB0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249788, "uuid": "daedf7f1-99e4-4382-86a9-8c9628b1cb06", "value": "3072:NEVy5gAZrk7LdZXRdoLmpMguHcUyVUHalw7WCuH0XsfC2UKGQ74XCOK9QWso8SyF:WE5uoLmpMguHcUyVUHalw7WCuH0XsfC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249788, "uuid": "2c403878-4953-491f-9e2c-e146a6689ef5", "value": 174716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249788, "uuid": "db63a923-598e-4b3f-9d65-4a1172bd11d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249788, "uuid": "7f8289a8-8b9d-4635-a9a6-3f21c26d3b29", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3441cfd1-8a1b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785198487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198487, "uuid": "8286a5b2-97b7-43b8-862c-f0242e603fbd", "comment": "Malware payload", "value": "fde76ca061b2320b0e66c4e19935926d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198487, "uuid": "2bffbda9-6fa8-49f5-bbd5-4c0c999fc3ea", "comment": "Malware payload", "value": "50d5984d193e2505338449d7594f394a4aa6cdd55370706f1d12dfb0e32e3183", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198487, "uuid": "2a7c43ef-eaa8-4c52-a699-0e2bbd0bfe80", "comment": "Malware payload", "value": "2d4286ca3c7706aee0b49f2b4d14e667824a5bf6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198487, "uuid": "492e4710-2187-4b61-bd5e-bf43d0ca5324", "comment": "Malware payload", "value": "86124a1459ddc93f97b3b6671b46ae9537f690a8ffc762605a7dc77be157cc97836744f2ce5dd03a734d8b6ec1381218", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198487, "uuid": "79a3df51-6e9d-4edd-be25-2aa89e073b6c", "value": "T145236C6516857C14AE98C4375C7E2F0CB9AD43E6314492EE7FCA3CF28C4A6ADA20871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198487, "uuid": "380b01a1-1fef-4d11-80fd-b95d7a91bafa", "value": "768:Fr9NyXsZztCS9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:NHusZOcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785198487, "uuid": "b41833b1-1100-47fb-8160-ba7b8b131fdd", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785198487, "uuid": "74a8c2a8-a4bb-47c5-a422-7110aec41f41", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198487, "uuid": "87faa578-c90c-4a3c-a36b-3fa1a82e158b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad763f9-8a88-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785245635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245635, "uuid": "f34583aa-3f77-40fd-9060-b41053580503", "comment": "Malware payload (PureLogsStealer)", "value": "ce7d00292e5012a93207c63daef53c67", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245635, "uuid": "55d009fe-45c8-4fcb-af31-184395edbba0", "comment": "Malware payload (PureLogsStealer)", "value": "51147a93ee2f3b3ac60c446435c96e72bdd54a1c0fb27cda033537f88c3690a0", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245635, "uuid": "18ef455d-a46c-482b-83b9-300e8adc1a57", "comment": "Malware payload (PureLogsStealer)", "value": "5a94069f639103c7fb2601df2899db37f2b780a7", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245635, "uuid": "44fb1164-53f1-48d0-9e91-2f0a6b67def3", "comment": "Malware payload (PureLogsStealer)", "value": "6f3ad7ba4f1a281ece1a418d2224f50bd323b94baa2549094612aa3388a7048c5689b21acd3c7ea593dfa80b8af8af32", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245635, "uuid": "a80ac00c-1f41-4dfb-80bd-cde94318d39c", "value": "T13775E011E3E152F8E227C174CA964233F7B678510760AEDF1254D26A2F3BAD46F3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245635, "uuid": "442ddef1-c5b1-4879-934a-88913c9e2ae6", "value": "71b008ad892c449add994b5e45fffabc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245635, "uuid": "2bec71b3-f44f-4470-a03d-96380fb80e9e", "value": "24576:UY6TYOe2pP1y2DjTHcmQhPT+mP82giMIRuTv+JmQotrGh4t/MMoe1wLwin5MdxCa:UY6TYOEmQB+mmuOG4QUtkMJWLwa5MrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245635, "uuid": "b66ebc72-0825-4ea4-9ccc-b92ec52cc4ee", "value": 1641984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245635, "uuid": "f2cc0385-85a3-4aea-b3bc-573c9ccc81fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245635, "uuid": "d9eb5080-3718-4a76-9649-6d571fb28087", "value": "51147a93ee2f3b3ac60c446435c96e72bdd54a1c0fb27cda033537f88c3690a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9734223-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221071, "uuid": "0102dbe0-7109-42b8-b12c-dd7d9bf74653", "comment": "Malware payload", "value": "50bd871daa4cedb0432ba9361fd469a0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221071, "uuid": "f1e3a10d-47bd-45f8-8da2-9b145d934dcb", "comment": "Malware payload", "value": "5154e955b21691db5bcf77d1768adc2b092edd8916161561db966f8c7b726d62", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221071, "uuid": "61e72b04-2f94-4d6b-a9f0-9cd28d905aaa", "comment": "Malware payload", "value": "d25c08e0f74a01b53ad0fc2a955e17296917cf10", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221071, "uuid": "fed69209-d502-477d-94d6-c53110c3d058", "comment": "Malware payload", "value": "c156405f6781326b52d9cc4fac6703453a41860c1482e066ba68cb0a66b2e216d3963870e94aa427fbbf3d4858063fbc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221071, "uuid": "f6c9f6a6-4bf2-4828-bef1-b576589cded3", "value": "T1B432AE041C4E84061043F7F2EABBAB765377B429835A28BF8E46229C2F36B09511E71B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221071, "uuid": "9e90cd5e-8052-42b9-9c8c-f44b55cbd097", "value": "192:qDTB7wnwzwCkU+NyPVQMHzwVszaiokfcJrNblXI4oWrryYbGPFS+a/U1ub8:QYwzwCBWMHzwVgtoocJrNpRFrryYbGf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221071, "uuid": "58afca28-a727-4383-8628-5b3d0bf706d9", "value": 10914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221071, "uuid": "5a676624-7682-47f7-8d80-b42e818a7803", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221071, "uuid": "f9945cf5-0503-4c33-af42-70232f35aee4", "value": "images_20260728_050146.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6770f206-8adf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785282754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785282754, "uuid": "35e7b44a-1649-4b38-84ba-df27f33a0368", "comment": "Malware payload", "value": "2fc1254ae188c5a5f04ee8eaec1b19a6", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785282754, "uuid": "38b99cc1-c3b5-4f3e-8926-86a8374b5f74", "comment": "Malware payload", "value": "5180b1ff84229f3034fec1de2534600cb07999a71bff2bf6319199a38320a187", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785282754, "uuid": "377fc80d-918a-49c0-9c38-7f5925ad8e71", "comment": "Malware payload", "value": "f746e8decca83830a611619532c1f9760cc1b11e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785282754, "uuid": "1c06128e-75de-4624-ac8b-cb661a73dc5d", "comment": "Malware payload", "value": "aac3dedcfe4b8463ea241a096ba3695ad8da2623159269ea053bb622b2670dcdc4384fc28fd71260c286c3608dff1523", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785282754, "uuid": "3e4e83ff-002b-48c1-88eb-aa1f4cee75cb", "value": "T13EE6339806E112EFED63927CC9E265B0D19678760731C6DB6BA823F16E472D08D3D713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785282754, "uuid": "4d9dd7a2-d86a-4ca2-8343-0b055e0859de", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785282754, "uuid": "52cf058e-9cc8-4205-ab0d-7160ee8efa4a", "value": "393216:NgLSWPmHsNW1afFW3Dnj7XMCHWUjXPcuI3/PGTAI:NgLS6mHs3FgnvXMb8XEH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785282754, "uuid": "77c81f32-4363-41ab-bd6b-7f54d82c0754", "value": 14313616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785282754, "uuid": "a96cb6b1-58c1-4ba8-9793-46c7712b37c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785282754, "uuid": "f9dac76a-f1e5-4546-98f7-3314f5fc7ac5", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6ccae8-8a6b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233179, "uuid": "d4029f11-f1fc-45d9-94b5-12b09d13fba5", "comment": "Malware payload", "value": "f3e9bccc6a1a1a023b196b8c4fae4306", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233179, "uuid": "f54d403a-43ba-4611-aef9-3ea8947ba5a3", "comment": "Malware payload", "value": "51828a61700300d2b96d24d50c813b849db201b4266c5fa4785579f6d790e163", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233179, "uuid": "3e6ad20a-427c-4cf3-8363-d749c15522a4", "comment": "Malware payload", "value": "874cfc4897cdf4e969f4548c6eb926ebfba07343", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233179, "uuid": "f4c8fa13-2fe9-41e3-9de0-b18e92a5edc2", "comment": "Malware payload", "value": "8a5349cf70e5837e5362f2821dc19a0f96deea73dd8b74fc564533ed850b90616ced31f863d4bd311c35fc6d9083c690", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233179, "uuid": "1aef0341-9334-4e9b-be77-f641ac0aca57", "value": "T103029E4FDC87B888E020DC7367A0A9763000151B04C98F86BAB5A36E425EC1965EE2CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233179, "uuid": "7dd81ac1-334d-4fa5-a9b8-5bb91a249289", "value": "192:aPVnNbzEB3vgZRF9mT+1PXLBX68Qa095DMM079MIse+qoc:abbz+3It9jXLBK8Qa0JKMIsYoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233179, "uuid": "ee6483af-c9d0-4cab-9025-7bc73bf731fd", "value": 8869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233179, "uuid": "66759945-aad4-4fbe-b3d5-05a4d532ca2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233179, "uuid": "f3db4137-c084-4fac-848d-130126bfcec8", "value": "images_20260727_205138.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7740b0e4-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785211054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211054, "uuid": "88c6c3a8-f118-4982-89cb-3ec7a1721fe9", "comment": "Malware payload (Mirai)", "value": "3cbadf7a21dd11ec72afb3edd1d7e425", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211054, "uuid": "b099ca7e-6ce4-4748-9302-1bd8d555659f", "comment": "Malware payload (Mirai)", "value": "521fde08efe2ab747ba0f6d801171e3c7e69be69193900724fe70887c4fe547a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211054, "uuid": "e6f5f7f5-74d9-4e30-8bf2-7a6e0ff7472e", "comment": "Malware payload (Mirai)", "value": "36a4661d2f4b4c1117ae7f987b7ee06261fd0060", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211054, "uuid": "4bc7958c-f856-4a17-a8f7-1de76432bb7e", "comment": "Malware payload (Mirai)", "value": "20fe894a606fab7d070fb425d515afc103b99e979796eb5ea290b9562c15d678c838848cb1b2a166298c7cc791335171", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211054, "uuid": "fbd97156-a9d2-4885-96a2-510b7fade211", "value": "T1CE059E1BB2B3B6BDC01BC03047DBC6B25532F0751A322D7B26C4DA393E96DA5171AB25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211054, "uuid": "aaea1d02-fe23-455e-bbac-4eb0c7f480fb", "value": "12288:AHtY3ok9gLRf2OVBCQ+e2Ngwe/eMdHH5nKmUW6woDWlayUpY7HXaX98qVwm4F4:Ai3okyLRfV4QN2Ngww9R6woDrYCVwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211054, "uuid": "3ddbac38-b789-4605-bef1-9bd45542df63", "value": 849816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211054, "uuid": "b760ee85-c9e9-477c-97d8-b5ca8fc93474", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211054, "uuid": "c542ea8e-9c3e-4106-b534-9bd5c0865476", "value": "bot_discord", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e037ef5-8a79-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785238876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785238876, "uuid": "2656194b-8a60-4570-bda7-84b98b6fdcea", "comment": "Malware payload", "value": "6082baf4f00f5c9ee1342c317a249315", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785238876, "uuid": "f1a56724-1524-4223-a394-596b5277135b", "comment": "Malware payload", "value": "5226f74141621e9e9b355528e34bce25ec96e725ce0806d6bc0d9d209e7678fc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785238876, "uuid": "e7a23dc3-2d55-4bee-9791-8ac9ba089ce5", "comment": "Malware payload", "value": "dbe95d5425857a1e2ebbf0af1b92a20853b93c98", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785238876, "uuid": "27ef6799-abd9-42b0-be6b-dec17f4b2f22", "comment": "Malware payload", "value": "b4f504da89f6ee4b9162e1fbffab6702a8cf27743a52aa9abecc6257620819a4cfd8179f4856ec83588cbca0aa09885a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785238876, "uuid": "9b654415-4e33-4ba6-8acd-3db549b6d497", "value": "T1B8C27C966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785238876, "uuid": "a5880eeb-33ca-46ec-ab32-456c09224bb3", "value": "768:i8vCB+25j6es8Rv9FYpMSUpi+20qUpi+20YQX:i8l25J5d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785238876, "uuid": "8ff1d848-43e1-4cf6-992d-669a92066772", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785238876, "uuid": "2b837da9-227f-483e-8107-3f441febcc4c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785238876, "uuid": "a778dd6e-24b6-4d6e-91d1-ad0feef013de", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5345ac3d-8a27-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785203693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785203693, "uuid": "915bf9c5-c990-400c-9f5a-87c401017129", "comment": "Malware payload (CoinMiner)", "value": "1bb73ccfdacfd31c472d9f6b477eb55d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785203693, "uuid": "f19565b2-4634-4732-b24c-7b9380529281", "comment": "Malware payload (CoinMiner)", "value": "52f011851639a0c3a5ac55a68314d0b11d6893805f93f0934a4b72f5c3c6d15d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785203693, "uuid": "d1651123-28f4-4dd5-827c-84a9c257878a", "comment": "Malware payload (CoinMiner)", "value": "7f2d5191f591515ba76b90bd34e4a74ebad68785", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785203693, "uuid": "5f29672d-afe4-4670-94e7-b2038d353237", "comment": "Malware payload (CoinMiner)", "value": "e1728b3fcf701640ca460af9e3e691c6afcb6338e5374419f479c5b7d27650f4fbe3945d69e6110aec57085f24274e30", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785203693, "uuid": "1e5eb3ed-89fc-4a07-9acd-6ad13329945f", "value": "T1CA22B21E2E4B0321DE5008B0E5B5464A943D1EE37346FBDBE632E5CB0AE5E4484C1AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785203693, "uuid": "5f6f48b7-b84c-4366-9247-2ad62b7623f3", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785203693, "uuid": "eed8fb6d-dbee-4ba6-b3a2-5091d552e357", "value": "96:pd/ozKYz/J4hOE+b+5BHCdyl/DLDxSikbO8dSTzWjPFJxGE9mZ2FFhJC7tCEeczl:3olpS5BHVxSHO8dfPFJxTEZmFhqecRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785203693, "uuid": "7da17678-761e-46a9-a56a-3ad07e28c40f", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785203693, "uuid": "8e97c44e-027a-4061-be2f-4445b5ac56a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785203693, "uuid": "21d31d1e-119f-4935-bd1e-eee71c1b514a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd789bbd-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221104, "uuid": "287d7a2c-3c41-4594-a4cf-9fdc91a9481d", "comment": "Malware payload", "value": "1c7763f0f1641d52210f0e2a949b7aa2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221104, "uuid": "ba01ec26-d326-431f-9a9e-ae42f0582419", "comment": "Malware payload", "value": "539d9c229864b27246d65471f93ce037880beb87984384a533bd565c33d36f2f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221104, "uuid": "51069b49-db5e-42de-aa56-7195e6d04139", "comment": "Malware payload", "value": "97571815193691f7d9418107ea2de24ce963d7ab", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221104, "uuid": "20347132-a005-45df-82f3-7bb3bcfac1be", "comment": "Malware payload", "value": "cacc2f6bcc9cfdc0869f7ffd3a1d673641a6ae38816394abf8366c693c5b4bc9a590a515515c3d0d1f927183c3894e1b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221104, "uuid": "6030afa3-9abc-49d6-aec8-4a3743b12b9e", "value": "T1BED18D2CF0EA4E2BC3F7851236D10B9295B68A10B6209A23F6ED55D4A7531425FB13DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221104, "uuid": "de230d96-14d2-4a91-8b4b-f67de2912491", "value": "96:RECk8lhtWCZCzihaf6TJzdH78F/zAHUtP15MUzNk0Li60XPjYlsnoz7:xk8lhrc2WYzdwhzJt/MwK0L0MuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221104, "uuid": "ec5fb80c-590d-48bf-bb0b-5462df192437", "value": 6460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221104, "uuid": "259ab96e-c632-4359-9d53-3b988bf4c6e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221104, "uuid": "9b927ace-a790-4017-aa57-db78dcadf764", "value": "images_20260727_122622.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762f3208-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249707, "uuid": "9cb4c15e-0bfd-46ed-8cdb-7615b11b4b6c", "comment": "Malware payload (Mirai)", "value": "a51d7c39837c569fb779b3dc4a242ff1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249707, "uuid": "b50e9de0-6d15-4433-914d-7724c5e60c68", "comment": "Malware payload (Mirai)", "value": "5430575aac2bbb7c84d1c050f7aa2542480a61e04ac09e67c185ba933d7d9307", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249707, "uuid": "82bb306d-cde1-43b9-a232-f9d2622fd756", "comment": "Malware payload (Mirai)", "value": "c1253d307f445f291f14be25889de7984f42b571", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249707, "uuid": "681a9ba0-c3b8-4d4e-bc2f-02a2b3a21cc0", "comment": "Malware payload (Mirai)", "value": "cc903facfbd4ca19b3f238133dbafd84d0cf3819bdca0c03aec11a3acc78f41d90aa3fa4dd1f9a710a5866eff0904e40", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249707, "uuid": "4ba068a3-4b8a-4d1f-b55f-362ee55e892b", "value": "T123330270E260D6A8FE63453EEF5BC28AA7E407D651E53356152C40E4FA0B23267ACF49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249707, "uuid": "28563c0e-f9ab-41cb-9dee-c99df734a5dd", "value": "1536:lK/kHcp9s2I0kw/9lhWmDAegocUC/WoCHUzg:lKM8js25/9lZ4UAWpUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249707, "uuid": "4e1d7844-c611-4cc8-bad4-1be93474d06a", "value": 53572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249707, "uuid": "a159fa28-8755-4b3d-a965-06b9a3d6f03d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249707, "uuid": "7a1c2fd7-8ed9-4a7f-84db-84831d75989c", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6fc755-8a52-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785222368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785222368, "uuid": "8b63b623-6b54-4b6a-9057-069d13abcf0d", "comment": "Malware payload", "value": "f6d826d734fa5a9b4fc922bc04a62c88", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785222368, "uuid": "9cd6a7a8-b64e-45e3-8629-344df62c83aa", "comment": "Malware payload", "value": "5432f6700bea135302a64366214765a8b0bdb2b1658e2cb37b64a28b8edd79cb", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785222368, "uuid": "9ccdd9bc-e614-4e69-a306-23bc0dbaf559", "comment": "Malware payload", "value": "6ee4231fc5b53ded1d50ba55af8907d7f581c217", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785222368, "uuid": "74e5c04f-78cd-43fa-9874-967068fceb0a", "comment": "Malware payload", "value": "f63aa2c2dc83f09c263d1b9667e594d70b5f3972e17ae0b40283b419774f256460b81a1fe0e6521425ea8322a3374fc2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785222368, "uuid": "6dc3e8d9-af9f-4c28-af96-c547d579dac3", "value": "T1EB9633957C8A5B39E187CBF0A591A0AE7D2A3FD13E128C0B3B4B72590D7722543B7349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785222368, "uuid": "1d6bad2b-4451-4a23-88c5-7711c255a5f6", "value": "196608:iw27JNURVCR/h0OI+XDbcIXnpKc+VSr/W1P2EExFtk4:jzCRZ0OI+Xtn85Si8Ftk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785222368, "uuid": "654cdfc8-1f4c-454a-ac69-a14d246665cf", "value": 9441280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785222368, "uuid": "ac84a093-0ac1-4b45-b58b-1297ecb6a604", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785222368, "uuid": "bc45810a-b7d8-4290-a420-42c9be2254cd", "value": "Install_966r30010.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48829fb7-8aa0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785255644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255644, "uuid": "db3f649d-6ff3-4806-9129-cfa28d7b59ea", "comment": "Malware payload", "value": "a55afd4baa484c7e1133a4ba46bd64dd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255644, "uuid": "d91ca0dc-0c2f-4194-9807-68bf5003be83", "comment": "Malware payload", "value": "54724e7230d770fc5f059d6b78cde6ce9f6fbf51a997e382125b25bbcc85ca66", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255644, "uuid": "e4cf7ba6-b475-4f8a-a1d6-95acd34df0ea", "comment": "Malware payload", "value": "0b1285e7d9612fd650d72d9fdb7e83bcdfb55c4c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255644, "uuid": "5b1fdc39-b7b3-4948-a907-e107e242719b", "comment": "Malware payload", "value": "729b603a9254b20c7340308cefc602b686ac6aacb1ef662c64468905d6564e9f8d6c2809a4096430899170acb21b7013", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785255644, "uuid": "ee300009-610f-4b52-9a18-b52c4b6e06db", "value": "T1963152E2A50604F406CC1E719A5837C9BE0CE3CA4B036EEAE953D8F944D3F6C7017644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785255644, "uuid": "d4d30d87-b163-49b9-b023-99f842761c22", "value": "24:a8Orj/Hxn2OlVfc98qUfhTFXIRfyIdqUfhgP27TSMHUdNRtVArisC:nOrLLlVk98HTFXtGHgCT/HVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785255644, "uuid": "d1b7188e-cd65-4276-b317-2ada786b81dc", "value": 1682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785255644, "uuid": "02a88c0f-4387-44cf-aa8d-bc99d362bbe2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785255644, "uuid": "fa2b8403-d3dd-48eb-92d3-a03342625b9c", "value": "54724e7230d770fc5f059d6b78cde6ce9f6fbf51a997e382125b25bbcc85ca66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b24ff0-8a51-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785221808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221808, "uuid": "3930f8ea-8dce-4a14-b92b-86d94fe8f47b", "comment": "Malware payload (Mirai)", "value": "5ac7e6731235dc88f22e641c0afcd728", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221808, "uuid": "6d5e6446-51f4-42e8-83cb-e12eada06c55", "comment": "Malware payload (Mirai)", "value": "566ea02de514047d08f1880ced14c9e8034b9c480e0cfafc0d268a513f277bda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221808, "uuid": "56f84048-ae6b-4248-9b02-88ca3b8a4f33", "comment": "Malware payload (Mirai)", "value": "cf12325d172599b6c91644c152295c28ffb45a13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221808, "uuid": "2c2ca2f9-c29c-4351-b45b-ba517ee86935", "comment": "Malware payload (Mirai)", "value": "1dd7ac871012ae564c260236db54653b9b6f87bd28c10fb864a9471a6bacd931f03d38fce4ba472786ffffb269e60619", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221808, "uuid": "c0ca12ca-a6cd-4c92-8056-840e4aa86a2d", "value": "T124A3E94AAF611DB7D81BCD3705AD0B4635CCA60771683B753938D828F68A54F8AE3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221808, "uuid": "f57d41bb-f869-4fcd-af8a-68452b94e788", "value": "1536:6Y3m3HYrgwxnXlBpR2JOL4SF8X2E6MjG8aFYwgU+au6g3BQsj3yLfhiat2ma:V1swxnXHpR2o8XCuL3yLfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221808, "uuid": "e0d18221-7a69-460b-b25a-842da87d88fb", "value": 101132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221808, "uuid": "aff362f9-8e9c-4320-8db2-ae5b69dc608e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221808, "uuid": "cc870dcd-590b-4b0b-b726-2003c2f006d9", "value": "aKmh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19938a5a-8a99-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785252558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252558, "uuid": "d59380ff-c52c-424d-af21-bb43fbe056d6", "comment": "Malware payload", "value": "27a1f40660216e69504b40282a991258", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252558, "uuid": "81c5114f-2f97-4c3e-9b45-f00acca57218", "comment": "Malware payload", "value": "56d8d75d76b5c6aa77e8f137f69e4ecba603adaa0e4ade069b4f503bce40c96d", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252558, "uuid": "4a3c26b0-5095-46aa-a47c-3f9eef1ffcb4", "comment": "Malware payload", "value": "2a90f1f5d9e5b555633e3db0d0f796c5f8b45099", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252558, "uuid": "725019c2-edac-4521-8adc-81e8ca7d6ea2", "comment": "Malware payload", "value": "9cb56b121b2de15ba3ff2f96d3683c83bc2317a4548031effd8a7c8556a0b271a43e2e7b5fb8110cbf67f587a3fce6e7", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252558, "uuid": "20ff5807-434e-4306-bab9-78f8e881a400", "value": "T142C11EF143B1C482E4BB7D01FF6A74CBA0D587FB699815CF5C65605BA2BC043A07E985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252558, "uuid": "b65ee22d-eb6f-4d2b-879f-0938de1875f4", "value": "96:BrIXH0I9IluXQyu0qBvUGPBGEFUWp1j8rH4qZ0imqPVjZGhbvNDOD6mX85PzH:FYUI+luTqV9GNN8h6ezH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785252558, "uuid": "88ab8dba-0c43-4c7d-99ee-2b82d040e5cd", "value": 6019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785252558, "uuid": "80ca2970-8123-4ec0-8ac0-412f5d342ea0", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252558, "uuid": "9881cdf4-70a2-41c8-b1eb-6c6cdaa45117", "value": "eBLXRaNhcbsPvpxEjK.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af5e78c-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785245904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245904, "uuid": "dedfe514-a9ad-4bc9-8fbe-27dd45c20b5a", "comment": "Malware payload (PureLogsStealer)", "value": "54f0485e4c8b261a240c0a94e292f610", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245904, "uuid": "6e188f66-7b7b-4a5d-9132-ee7d8e54499a", "comment": "Malware payload (PureLogsStealer)", "value": "581dc70066ef9ddf2feb271833a24d3c957791a863e4d82f5db492badac0abc5", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245904, "uuid": "4dcd13b2-61c1-4c02-af9f-c3c27b53b6a5", "comment": "Malware payload (PureLogsStealer)", "value": "e0fd87f54f46c6d8b3d71e913a6676db2c590605", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245904, "uuid": "169a4398-8883-4f5a-bd9e-143b9b713054", "comment": "Malware payload (PureLogsStealer)", "value": "eadda58c9c847f703d62a282e1ea587972c4516f672206fadd6364f3d7551f27ef1cf60a65ace8d6aeeca0b478e673f8", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245904, "uuid": "a103f9ce-4861-480b-80a3-9744993164d8", "value": "T153969D1AF79846E5C076D138D6529236E2B278624B3193CB52AAC72E1F37BD05F3E710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245904, "uuid": "0622429e-2225-4f33-b402-f52c4f1c1495", "value": "196608:vZhtC4ayHTkyXF9M3eb9cHy2Ty2rr1ENHx6tjXzPBk8CdR:vZhtuy1Pb9cHJy2rrMH+DPu82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245904, "uuid": "57c5cec2-f0a5-485c-8180-b1736e7fb6df", "value": 9330688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245904, "uuid": "6c118f3d-2aac-4987-b643-7eb9530fdad6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245904, "uuid": "6d8fe45a-f494-43e6-8afb-a7fffedfc008", "value": "581dc70066ef9ddf2feb271833a24d3c957791a863e4d82f5db492badac0abc5.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e361d0f8-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221114, "uuid": "d6a26b1f-e1f4-4b90-8c05-97d767802ac2", "comment": "Malware payload", "value": "094c4f9912f410825cbb3b7ad2303075", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221114, "uuid": "f81ac2e9-5724-4823-8b2c-154a1f81fece", "comment": "Malware payload", "value": "595c92fe40ba27dc9dd03d85c58c898cf4a3a6de2b1a1488f061cfdcda0dd12b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221114, "uuid": "31fa514b-2fdd-4690-8ea0-5fc2025939c3", "comment": "Malware payload", "value": "81784e97432bca8e2a971efde1f98580e2c97c76", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221114, "uuid": "6063acf0-9d67-4fe6-b359-a1c979b947bd", "comment": "Malware payload", "value": "8ab52cb5d4868fdc40bee159d7402066db3c3111898c81d75fc3b85058a384cda3262ed2e94bdd849a1a082debb02a21", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221114, "uuid": "b170099b-2790-4640-9e54-8bce1ad285ed", "value": "T1AC62D0DC875FA2CBC7BED264B7E3391035A366B623FB0A94B5496796D371411EC83010", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221114, "uuid": "c96080c0-5000-4317-b243-a340eefa3ce2", "value": "384:S8Wdv3dkqDI3YeDlr1+/wap5pQbdUyA9lUI0CEJvwa2ETwgbU:zW7Eplsb5kuyrR2E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221114, "uuid": "2c7931dc-b1b9-4075-879b-0733b9f7a877", "value": 15353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221114, "uuid": "aca3bd72-b1f6-4f48-aa6a-bd2402c3a3e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221114, "uuid": "86c1b04e-7a25-4532-aea2-e8a87e9260c8", "value": "images_20260727_171640.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c9e9c0-8a45-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785216746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216746, "uuid": "589523c0-2c41-41fd-8832-d470b1d303b4", "comment": "Malware payload (Mirai)", "value": "5e014662b70397f3446972215b388ff5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216746, "uuid": "5070126b-6b90-4f3c-933d-cb87d331b06f", "comment": "Malware payload (Mirai)", "value": "596708afb8304f000edd88a732d8aafdacdde890ccf106b284515f38bbad27d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216746, "uuid": "d23c33b0-f3bc-4d60-a641-1cc264a3038f", "comment": "Malware payload (Mirai)", "value": "54804e623fe8c95cc64070334d150e0b56a6e2a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216746, "uuid": "4851e6ce-fb8a-42f5-9966-5808f2013a0d", "comment": "Malware payload (Mirai)", "value": "722f181086910991e88e965e8cf494b8ea9daf59c8e1ff0ac1ea74485690e10c349d63a0d6d3126a49c6c053879486e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216746, "uuid": "67209784-1312-4fec-913d-89820fb80285", "value": "T182F47D2AB2B3B1BCD11BC03047DBCAB25531F47526212E7B27C4DA353E5ADA1136DB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216746, "uuid": "a6edf945-2531-4fc4-b5e6-fdd69273dac5", "value": "12288:5k5FWXrqx3xVetWTPR2aNgT59NnYdkH8Zq7j2aL76b/HayUNsHX:5vXrq1xVeOPYaNgTzgaL7a4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785216746, "uuid": "8540989c-0b12-454e-be1f-996b0aba947b", "value": 755824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785216746, "uuid": "ab3c0c21-4e34-485f-8c50-b4830fe2de9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216746, "uuid": "5ca6bbb1-a944-4090-848e-d8056b68db24", "value": "real_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23897c8-8ab1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785263203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785263203, "uuid": "f03dcf69-176c-4c26-a70a-c3cfde67c0a1", "comment": "Malware payload (Mirai)", "value": "767e17fdb97580979e56222dc4ecd0e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785263203, "uuid": "0313a348-1f52-4652-8f63-e28377bf9d2f", "comment": "Malware payload (Mirai)", "value": "59d7d3a604e5c3a999f01a662faab73a65f036c2e36f7e10c58c8ccd76967861", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785263203, "uuid": "b0da8ca1-536e-4710-aee5-ac361ddb882e", "comment": "Malware payload (Mirai)", "value": "d7457b85642b99ac3c300f43409aad1a0aa5bb5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785263203, "uuid": "eed0552c-5682-4e80-967d-ba81d6f510b3", "comment": "Malware payload (Mirai)", "value": "b18e0300b489525dab512d5821bc70f1266ca5b66b3c26a5d15d21f9b379d161af67d34c31244118571d099130a58fea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785263203, "uuid": "69f06519-dc58-42c4-bf14-bc845aa7af82", "value": "T14A14D81AAF510EFBD8ABCD3701E90B4639CC644722A43B753574D528F64A94F4AE3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785263203, "uuid": "bd073ceb-8af3-47b7-b0f6-90492ed82733", "value": "3072:Y/qYyOcQS9ijdHnBBtlYAZ5Vyt8KnuWMeU:YIObS9iNnXz3kQWMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785263203, "uuid": "86c50023-0d72-434b-aa87-67a5c8833575", "value": 202068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785263203, "uuid": "8db9c7b5-2da1-4c9b-aff3-2bd73ec3b942", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785263203, "uuid": "43db13c6-774a-4480-8c65-7d7f774d699a", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8a384f-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221079, "uuid": "142720c8-b57b-415e-98c4-87673ab9f85a", "comment": "Malware payload", "value": "fc847ec18c78deb4b5fb1f99ec0faeff", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221079, "uuid": "d881bf94-201b-4db2-91ef-dca0c097ddfb", "comment": "Malware payload", "value": "5ad145da9c048ba3bee372d3fa7f85ea9a48436e64db29956d9e3f84910b8254", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221079, "uuid": "bf8c5d21-bd09-4105-8142-9bb035bfdac3", "comment": "Malware payload", "value": "a86a8120b62db53a2bc2e13c846d7fab672d8f50", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221079, "uuid": "2700ea46-a944-4e3b-99fa-cbd8e2e1efeb", "comment": "Malware payload", "value": "836345d771407b0b4d33ec5aa5626bca0b6609a1283bb63054e4c7f6b41a397e441ce731ac162236117e5a8faeb4a960", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221079, "uuid": "bc54e3ad-8663-4046-9ff0-984fbb729e8a", "value": "T124615CFF501E3086F18960FA719E5AACEDE8BE44CB8E5B011276DAA87F51750156F038", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221079, "uuid": "89371cdf-91c5-461d-8656-92c3b59ee2bb", "value": "48:90r1kPeLihhJpsoq8mTazuK8b9l/3Wzc0n6nHpQ65p4wCBnb1b7zo/W5ZkDUb0x:Or1kiKAojeK8T/CA+I4wCLn75uDUgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221079, "uuid": "85f381e3-de7e-4330-9d31-1c893766d4bc", "value": 3412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221079, "uuid": "1c0073ae-1e36-4758-bc0f-c552928cba3f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221079, "uuid": "03a5e3d9-06fd-4809-91f6-eb793e66d1bd", "value": "images_20260727_194713.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d26bf24-8a81-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785242418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785242418, "uuid": "b657cafe-9004-4299-bee4-4aec83a29fc7", "comment": "Malware payload", "value": "bab6a9c8235038b3ebc4ccb0298005cd", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785242418, "uuid": "d1eaf64c-8025-450e-87f0-21c46ed002c1", "comment": "Malware payload", "value": "5c41e94e16d97a8e8602b8f21a6284c56edee42726a6d735d16b299dae10b815", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785242418, "uuid": "25813621-ce07-4570-9309-fae3f2a480bc", "comment": "Malware payload", "value": "9b6d399855b438ed0ba75828a9ce158ab17c201f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785242418, "uuid": "b71b9a65-bc48-40e3-8d64-a323176b23c0", "comment": "Malware payload", "value": "8c29d5996280b9e5cd7d3d6cad6ceee734d5ece6126a0a5d279e7126368b03774a8dc5206a48a9f27f13a339246d652f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785242418, "uuid": "1ae66d3c-72fe-45cd-b762-2db99cfb5361", "value": "T16C8633C63CCA37B1D087C7F04153A09EB12A3FC27E669D0B6BD875444E32A1959B739A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785242418, "uuid": "62b4c25d-a8a8-4c80-862c-c5ab726f591a", "value": "196608:x+b6VoPKiXflNXSPb59Rg1dHklfTjJrGQbtr:xzoVf/SPV9CG/JrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785242418, "uuid": "253debdb-b95f-415f-9754-ba1416e3f0b8", "value": 8105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785242418, "uuid": "2ace6ac6-075b-4295-b70e-d83ecf101046", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785242418, "uuid": "c0bcdb4b-bf9d-424f-9e7f-d05a151be30e", "value": "Install_966r30014.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8fd46f-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233261, "uuid": "cc95590e-124f-4cf7-b66f-d39c6cc8cfa0", "comment": "Malware payload", "value": "aa181484ed513b4a4a97eb679d080b75", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233261, "uuid": "e2905391-b43e-48a0-9f6c-0555050e2859", "comment": "Malware payload", "value": "5cce9887165a8c8bba0d4ccb8af29e77d82aeeec672b216becb3c8f79205ea01", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233261, "uuid": "57c3dce9-0ba8-4220-82a8-eb6f0aecafa1", "comment": "Malware payload", "value": "b6b5e3c786bcb417d827bd0c1afe2bd0644d8ef8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233261, "uuid": "cede1178-c148-40bc-809e-93b858752366", "comment": "Malware payload", "value": "892c3dc321c964eda78091a113d6f59b1a08db06f1450f47cdb91a079cba382a7c4f21b94f8a73ee102df5220bd4970f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233261, "uuid": "f2143c99-fc47-4264-8f23-7ed25db1437b", "value": "T1A5C1AFE46A0F2B00D17CCC7B1F8B5A49591962EED2C13E8FE93B347D356FAA42509151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233261, "uuid": "b929a3d3-43e0-42b7-9baa-55cbd10f46f1", "value": "96:6VQI2PwQOfmg6CYrQzYoEbnkUj22YzfPd2fXg/cVDqgIiSZgbMgOyhc22Pkdi0pa:66I2PwmgwUQbnk+NUfPdEeyTSL8hcPk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233261, "uuid": "a2e8bb5c-18d0-4e8a-afd3-cf888d24a9e4", "value": 5915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233261, "uuid": "1ddeef1a-651a-4bdc-8e9f-047e745ce184", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233261, "uuid": "1fd54a6e-1a60-423a-82bc-fdda473cbf3b", "value": "images_20260728_051319.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f092155f-8aa1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785256355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785256355, "uuid": "da262bab-eeeb-426e-9f37-292f4ab41c01", "comment": "Malware payload", "value": "78629ecf2c2ee465d1cc7c9a53c1fb3c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785256355, "uuid": "2ef6ee83-a909-4358-974d-58add22e7598", "comment": "Malware payload", "value": "5d53aa219c7f3e699972d1a52c215e278d75ff464c7ad5171c0017303b382593", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785256355, "uuid": "c54852e0-2a70-44dd-b691-ff7575613ec3", "comment": "Malware payload", "value": "75477f838d03c1a700d611eddc9ee7d51fb03bc2", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785256355, "uuid": "f1c00db0-cb98-408e-a914-d96c4f0f2152", "comment": "Malware payload", "value": "46e8bf8321e7b6feabaad1b9ec6eab6459ec26debb0966847ca56fea45b2780ff35f94a52441560bfa9f57c5e3e999dd", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785256355, "uuid": "4e465d0d-f023-4e5a-83ec-f04e6dd7e44d", "value": "T1C5662282FF46D52EC873403709964732631ADD5ECA8A934794EC3A295C77AC84FDAEC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785256355, "uuid": "281278b6-902d-41ab-94f9-d384955e363a", "value": "196608:TQ3zMB2rAaiULeYgnvhco+d7xO9i4uf1ptll:kD7riULe/v+o+2uprl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785256355, "uuid": "a863e478-5466-461b-8e1c-be8ce46722a5", "value": 6589792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785256355, "uuid": "9b489ea4-3198-45da-937a-153cfe3362a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785256355, "uuid": "d7780053-4ac9-4c51-b113-738e7cb64a74", "value": "P\u043epn\u043e20+.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d018cd-8a8b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785246829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246829, "uuid": "fd3677c8-2e52-45cd-b29d-665d8dd65c0f", "comment": "Malware payload", "value": "f8da1f02aa64e844770e447709cdf679", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246829, "uuid": "242c6311-25fa-4fc3-b87d-9384aa80d13c", "comment": "Malware payload", "value": "5dd77e8d7d97b876026800b045c80e448fdef19f5549068b65dd4e2178d52a65", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246829, "uuid": "e019eb33-a103-4eb2-9232-bd72a28b1186", "comment": "Malware payload", "value": "6b94ea63e63cf4a3b735d5a3d884e8549cfa421f", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246829, "uuid": "c330381a-8f9f-4be6-8ab4-af6de46b6442", "comment": "Malware payload", "value": "c779d73402e027c5e0ea4d99c1c69011ae2a4be9d82b3734dacb6d501feb94269efecb7f95bcce99d9a42f4ffbcb3891", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246829, "uuid": "99b9b66d-76d1-48ee-ada3-9302705ed382", "value": "T133D02315269C4E8146FDBC45D51D0042DB10516B03140D842DF1FBB443B49447817051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246829, "uuid": "173d1d43-47df-42e8-ae10-682a15587f20", "value": "3:hGYBcXYsuBILedRZSdTp9ZexKeJNHEWATR7cNUA4AFqWX0g6Y2OFNE9wZOF9cb:qXQtQjZeMeDkW2AUA4AQWXP6YdFW1F9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785246829, "uuid": "c3bb6e00-f591-4eee-9b64-982c12690eee", "value": 212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785246829, "uuid": "d1fa2894-f44d-4c4a-a913-4d10d4c9d2da", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246829, "uuid": "4a4054a5-d57e-429e-973c-ffdadae3f1c7", "value": "accesson.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f534b2af-8a88-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785245625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245625, "uuid": "0174889a-d64b-4b8e-b065-19431e5fff3d", "comment": "Malware payload (PureLogsStealer)", "value": "accc992b82f7332df297b48a2c778301", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245625, "uuid": "92cb1c53-4011-4f3a-9f6b-076262406280", "comment": "Malware payload (PureLogsStealer)", "value": "5e10c356f7a41764011d102094f4823f2dce439c5cd50c68c23e3328de9255dc", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245625, "uuid": "57e79437-c60e-483d-8d35-0bf7d4c1daf6", "comment": "Malware payload (PureLogsStealer)", "value": "fc2d83d15c58843337d2b123bb489be398227f8d", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245625, "uuid": "00492312-48de-4704-ba2e-0b75f1a25fdd", "comment": "Malware payload (PureLogsStealer)", "value": "b8f586c5673e5d7e9c560b8dce4069a634e8c0ce3fa2cab08da1fc32c0d7d3737354f6ae45eb4f3fcdf36eeaf54baeb1", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245625, "uuid": "992c9b7f-fc7b-4885-8633-097ec7970ee8", "value": "T12C05BF2B72958F21C18A6772C2CF491093EA964736ABE70B758413D71D033FEEA06397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245625, "uuid": "6ea97012-0381-4e5f-87e5-734a9e6efa65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245625, "uuid": "55924081-79e0-4817-aaf8-b0cc3bc734ed", "value": "12288:D/KnaEY193a3z6dmuXKurBkarbYmkaO8QwHe8UeDe:DF3a3z60uXzkaQmZOLkeNeDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245625, "uuid": "a7f806db-14a5-4ff2-bce6-855d9268d63b", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245625, "uuid": "3668ae29-1ded-462a-8dd8-a145f0234468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245625, "uuid": "994563c5-1f1b-43c2-b8e3-07ec73621a18", "value": "5e10c356f7a41764011d102094f4823f2dce439c5cd50c68c23e3328de9255dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb460c9-8ab6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785265286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785265286, "uuid": "3049e41f-6ec2-4261-ba64-77f7fd12ddab", "comment": "Malware payload", "value": "1ed7223bd26d5daf2b3120da798e7942", "object_relation": "md5", "Tag": [ { "name": "Babar", "colour": "#E51673", "exportable": true, "hide_tag": false }, { "name": "dns", "colour": "#7530DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785265286, "uuid": "54340b48-02ca-442f-94d8-5073c9e9c56a", "comment": "Malware payload", "value": "5f1225fee9a3329606862f1f8b2e4100f06e9b3c874cd319f763dcdd030a650c", "object_relation": "sha256", "Tag": [ { "name": "Babar", "colour": "#E51673", "exportable": true, "hide_tag": false }, { "name": "dns", "colour": "#7530DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785265286, "uuid": "5c7d6af6-01f3-4e1a-a29f-c821af8371f4", "comment": "Malware payload", "value": "9effb84c10917de2eedb8b66e3e50ec1a67e2fc6", "object_relation": "sha1", "Tag": [ { "name": "Babar", "colour": "#E51673", "exportable": true, "hide_tag": false }, { "name": "dns", "colour": "#7530DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785265286, "uuid": "3064ee19-bb4b-4bac-a7e4-b47b19f65365", "comment": "Malware payload", "value": "179a859056d3a5e2e20f9697f47e05a584bd7c87a3849cab339ce0cc61466ab756388f797e87e7c533673c3a9c6d6b09", "object_relation": "sha3-384", "Tag": [ { "name": "Babar", "colour": "#E51673", "exportable": true, "hide_tag": false }, { "name": "dns", "colour": "#7530DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785265286, "uuid": "0ed654ab-a8eb-4c44-afc1-23ec2eb917c3", "value": "T157F5F13FB28B753EE06E5A367A76A210583B676165138C16A6F4C84CCF250B01E3F797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785265286, "uuid": "a4bd17d1-d9ad-4265-a869-55e4613357f2", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785265286, "uuid": "a8fe9223-560b-43d7-98b5-b3a5aa945e04", "value": "49152:vuI3hANFl6Op2KHPMrp9cEYX40VK/32EgqAmlVDyn1PC:v5xANFl6S2KHEUE0440TJ/Dyn16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785265286, "uuid": "d1ba52bf-8ef5-432e-94f8-05da14f07bf2", "value": 3334888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785265286, "uuid": "6578cd00-6604-4050-a6af-13b0ba3e0841", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785265286, "uuid": "9a25183f-fbde-4cc7-b3a2-4124bc3708ca", "value": "CrossDNS_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5002c2e-8abb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785267395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785267395, "uuid": "ae3ce71e-e2ec-448c-a3fa-76bc7ad141a6", "comment": "Malware payload", "value": "e1b655657e09f8d882fce9ca90139fb7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785267395, "uuid": "ab3ff978-1c39-4f94-aec4-1d7301d876b2", "comment": "Malware payload", "value": "606f4256012f37e7e120966888e6a7bad12abb004e135c4f663bc73e124699ea", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785267395, "uuid": "1d39a3e0-48d2-423c-bf69-c5c667b16f3c", "comment": "Malware payload", "value": "5846dbbce0d4df103d0d0fb19a3230f8a87b0d65", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785267395, "uuid": "6e3adc4a-4e77-43cf-995b-8d1cf1ed70a1", "comment": "Malware payload", "value": "9bfcb7736eff599bd48642984811ae677c30f73419088b830c5d363316c66ce3fe4f4e635af8754f686090c47c50cb80", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785267395, "uuid": "65001fba-6cec-4258-beee-edc5b131078b", "value": "T130571285F6518879FA5F0231A6FABF08547BFCEA13D4624934E8B118A3E3ED90D520D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785267395, "uuid": "f8e15714-03c7-4b73-afaa-24a3c2725832", "value": "393216:Pp1s7O5Sz3ds708J/LrRQLJg3g9DGH0bpZlJjfFx3O1lP1ICVmTovfYwOv4QS0V:v1qNgBQL+3g9DGHWjdxyICVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785267395, "uuid": "0488882a-7683-4573-a798-b3c702c0c59e", "value": 28986880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785267395, "uuid": "d15f8d93-f6e3-434e-937a-1a6367070977", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785267395, "uuid": "dd7e6a26-c83d-4bd0-9695-70875199bb05", "value": "5.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c60847-8a61-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1785228478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785228478, "uuid": "465c00b9-c15c-4690-80c4-d23a4296d0ff", "comment": "Malware payload (SilentNet)", "value": "70d7d059065bbbd1da0d1f7c2a37c096", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785228478, "uuid": "b65aa813-ea4b-4893-8dd3-6acf7f2a3eb3", "comment": "Malware payload (SilentNet)", "value": "609139a29d2c832d1f34d4b277b0f4c136bade8536ff5431a28025aea37a9f02", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785228478, "uuid": "0ec69f67-1298-4837-ba18-18d0fe469ac7", "comment": "Malware payload (SilentNet)", "value": "713e454b104cf0c3023d12f875b2dfeb6d88877c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785228478, "uuid": "73e8b2c3-e31d-41c1-ba4c-180750cab8bb", "comment": "Malware payload (SilentNet)", "value": "7ac4c5223985814e537442a5746e37d720168b2134a2193a0091f80ce0ebbab91ee9225905129004e149636188c4c91e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785228478, "uuid": "4c8f490c-e029-4974-ad71-a909415c9118", "value": "T1EF842321798837ECC42F79B418DCE7ECFA9F47A5954BEA52F1014FDC280D7089A1951B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785228478, "uuid": "3c76bfba-4f90-40bc-82e7-b7f8c3f01619", "value": "12288:WuHTdfuQNKgstRWnOl2oqI6ZnS9GfsG8/:WuzVHDstsOlGnZSKsz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785228478, "uuid": "03aedadd-c9a1-47a1-9449-8129f69c8c67", "value": 402787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785228478, "uuid": "e32f241f-6606-4448-8b45-fe64abe452f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785228478, "uuid": "2dca9815-5e80-46ef-9422-17c76c09be76", "value": "Krypton-Client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62dc567-8a45-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785216824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216824, "uuid": "bc521023-0b78-41d9-98bc-7be495e1f4fd", "comment": "Malware payload (Mirai)", "value": "79c9ff8bfde4fbd3f85ee0bb2f4a4403", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216824, "uuid": "48324a75-3cae-489f-82bc-2297ef9e10ac", "comment": "Malware payload (Mirai)", "value": "614d5f1badd839cd7f699a7ea337b348be57d01d7d454e8e60c062d3934377e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216824, "uuid": "cb3b5c1a-d878-42a3-9e0d-e5373bc81b64", "comment": "Malware payload (Mirai)", "value": "411932cfa6319d1d7169d2402886b2dfa6cdc2fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216824, "uuid": "72e5f9a1-cf54-4143-a73b-94a56be17e9d", "comment": "Malware payload (Mirai)", "value": "298a64e9305ddb0c2c67f41e87cb90d5c262c1fd037adc13593259dd8fa3155382d9b28bc4da3350b28ba9a127e92396", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216824, "uuid": "a2a74eca-f845-4619-bb8e-497a3d5b05f3", "value": "T1B0B44956F8809FA1C6C12976F64D86AC33174779C3EB720699245B343BEB86B0F3B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216824, "uuid": "b7e6b64c-e403-4adf-a81c-22909f58813f", "value": "6144:c8fTjmMcpQ+JWMCMUQITX6TSP/PphvNAOXWHdHBb4AHO0sZ4iZRDx9yWrrHHdgp3:ffPwLoM9C6u3PpBgm2OjDRDqqgpj1nJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785216824, "uuid": "27ff6a9b-fc35-4b43-a72e-35ea0a187c54", "value": 500916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785216824, "uuid": "d90be8ba-6e06-4eca-b65e-69d48d825432", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216824, "uuid": "9f2e0742-08d6-483a-9303-3e8e768030a8", "value": "real_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66925901-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1785224341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224341, "uuid": "8aba80fb-3297-46e1-bed6-e098e3235826", "comment": "Malware payload (DDoSAgent)", "value": "711963b92604ed5a4db9e882a5d559bb", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224341, "uuid": "a0ce43ca-f894-443f-9f4f-5d261cf229be", "comment": "Malware payload (DDoSAgent)", "value": "617fae426e2f69835997337a7fa649d1547322aa95ee904144db394357aac7a7", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224341, "uuid": "b94a4a19-62a0-4f39-af49-93695334ff4d", "comment": "Malware payload (DDoSAgent)", "value": "7a4322a92b540ce2450231051d5c7e4729a5310a", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224341, "uuid": "24e6fc2b-bcb1-4b1d-ad63-cbb9f9621dfc", "comment": "Malware payload (DDoSAgent)", "value": "28dedcea0a19c173f021158154a538beb559126694564ff4fce0a8e9c97e0ae130a74e5adb85f2e1b35c3e4d33dca4ce", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224341, "uuid": "0e231c75-edf0-4334-ae97-b8a2191e50be", "value": "T1E43608C1AD91D24AC63D6E31EFD5EFDCE22B2E315D885A4AC9C4F33E18B314580B59A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224341, "uuid": "42848898-98d4-492e-a841-706285e76e3b", "value": "49152:0BW/irqBaLM3LQiMutWzV5ROjIpbObE2gh7oZWiSJlMt5Es:0BW/irqBaI3LZYzGIQ9SJCjEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224341, "uuid": "299a77de-a759-4569-a11d-2a4abdf9a7ac", "value": 4915348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224341, "uuid": "503fa195-b507-4ff7-9541-a97f9ba76575", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224341, "uuid": "d3851826-800d-462f-aa80-45b48beca215", "value": "edac_polld", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa6e56f-8a61-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785228750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785228750, "uuid": "5d538f82-5f71-4cca-abd7-6dfb4140af26", "comment": "Malware payload (Efimer)", "value": "9db20e972d03665775e8e87836562619", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785228750, "uuid": "f0f1952b-e081-4a28-aaf0-04735be08310", "comment": "Malware payload (Efimer)", "value": "61b5291e4636aae8ea85b6d5d963f781c2160fb3bc6cf99c720a3c4aeede33e1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785228750, "uuid": "2a5cf422-e597-4a1b-90b3-5e3ff66334a9", "comment": "Malware payload (Efimer)", "value": "2de1b5aaa3eab9ebcf5fc786276e1ceeb3265805", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785228750, "uuid": "006b16e9-5b28-4b9f-a9a4-18065b7e3b2a", "comment": "Malware payload (Efimer)", "value": "592d635e25ca0c47cde96ca82182e65e040b834877b6245bae290035d66205d20ad8a294c8844744197c85805595d64a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785228750, "uuid": "2f731b40-68cf-4edf-ad96-15ec728fbe46", "value": "T19CE6331CA6E502EED6B3907CCDD34187E4B8B4B94BB1C58F8B9497A14F472E09D3CA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785228750, "uuid": "dcfc3bb7-0223-47bb-8bb5-636fde5243fb", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785228750, "uuid": "e3bcc63a-28f9-45b7-aee8-067197b83665", "value": "393216:cS/N1+JRiV+lEc2ARWJypHrSqEXMCHWUjXWcuI3/PGTAI:czJROc9rQXMb8XrH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785228750, "uuid": "0ce172fb-c9f0-4729-88dd-ec1a92ee1d8b", "value": 14282830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785228750, "uuid": "f62503b6-c4c7-49c3-bc85-15ebaecc2c61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785228750, "uuid": "ab698258-c7bf-4018-801d-3299a313c1c4", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c57f8b-8a60-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1785228438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785228438, "uuid": "40374028-4ffa-4126-9ec3-d39ce83a9e5f", "comment": "Malware payload (SilentNet)", "value": "2b3c1ca95ab73e09ff7c19ef66992543", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785228438, "uuid": "0a17e2ad-f73e-43aa-90c0-a5e4d2803e17", "comment": "Malware payload (SilentNet)", "value": "61c4218a16f11676f8ba7cb2adbc6d00801d73bafe0615b29509e187b0296610", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785228438, "uuid": "ee8ccd38-80e4-4163-9878-8bf7d34c59fc", "comment": "Malware payload (SilentNet)", "value": "829f82d877bb0de1e95cf0c82052c279e5a23313", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785228438, "uuid": "31ed8a38-24fe-4a74-a770-c79311d23cc7", "comment": "Malware payload (SilentNet)", "value": "90bda04a237c23d1a19b846455624bfc53af7de5a0014e92b87348cabc795295b2a3ce088c01e24cf725768a91640a63", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785228438, "uuid": "5530a50a-e55f-48e3-a1a8-7261d7871f00", "value": "T1BBF52323E56D61F7FADB92B391108E26FC681FBCDB06B4160FF31C91581289A0F456AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785228438, "uuid": "7151f100-38ae-417b-871d-8ed5ea979769", "value": "98304:O3g46ND1YMqzo75CVzYN3xagdGlPlXXUFNQ:nD1t/XagEltXkFNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785228438, "uuid": "4607e025-40b7-48c1-a09d-1cec12ac3e5b", "value": 3490864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785228438, "uuid": "f6839e0b-50cd-4f8d-b1b4-fec63c0ac6ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785228438, "uuid": "4a86ed10-6231-4286-a5ee-213ebd5b5156", "value": "glazedaddonxmeteor.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69066180-8a7c-11f1-bd95-42010a9c0009", "comment": "Malware payload (AdaptixC2)", "timestamp": 1785240236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785240236, "uuid": "e1b0d5b4-f291-485c-9033-f4c70ea11a1f", "comment": "Malware payload (AdaptixC2)", "value": "0a84486e20e0fdca44aa5ce8c3c121a0", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785240236, "uuid": "ce6566b7-10d3-4005-bc49-678b16ec8c0f", "comment": "Malware payload (AdaptixC2)", "value": "624ac3ad002bf57ad104a1153a4196e24d954086091348bcf7a0b57b38998dbc", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785240236, "uuid": "bed31f13-6370-4723-92aa-8c85be12547d", "comment": "Malware payload (AdaptixC2)", "value": "5d24f327f58e9deacc983bf49b3c7681ba676fc8", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785240236, "uuid": "2438dd36-6658-405f-b67f-a25dffcd0b76", "comment": "Malware payload (AdaptixC2)", "value": "5608cb445ef35037f5eeb691364c66d019fbfc485389deaeea95f542fed89b7b10b7d1304965207b91ee6ac7579a6c33", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785240236, "uuid": "3458b1f7-f26a-4ff4-aed2-29eaf86b15e3", "value": "T164C43C0B6D54B5E7C893917BF6236A446F7EC0304284916AD0EDC180EEE71E8CF5FA96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785240236, "uuid": "9e8a1363-5f87-4f8a-93d2-750a8dafd608", "value": "6144:WNKhu/2saICfdHmXZBZJz4GUQzUB98OdpW:WkcOsaI2dHmXbTzUjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785240236, "uuid": "7fb8b0ae-ffee-4c92-9a49-bd34120e4f48", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785240236, "uuid": "0fbe79d9-7c7c-4c44-89d6-249d571b5305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785240236, "uuid": "0ed15d0a-d532-4534-adf2-d4d9192e247e", "value": "RunTimeBroker.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7790c63b-8a7b-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785239831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239831, "uuid": "57eafd44-8f64-422a-a6e5-31eb17473d43", "comment": "Malware payload (PureLogsStealer)", "value": "f6996d9e9f587d804b8d87d93226dfb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239831, "uuid": "4457772f-b664-48ff-9808-1bab415ae94d", "comment": "Malware payload (PureLogsStealer)", "value": "624f9d23167fef7006ceed2413a6e491b69abfe918e07918335a90e97ffc4852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239831, "uuid": "634e6f18-2603-4add-9305-d65a6484f9b3", "comment": "Malware payload (PureLogsStealer)", "value": "5946a4df3bffa28095c867e6685e254362d8bda7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239831, "uuid": "62be2133-11c2-4dfd-94d5-8133990f2596", "comment": "Malware payload (PureLogsStealer)", "value": "b8849b86dec705d07c4457de7ff4ca0d81128fd1079b845f1d7fd10e3f459f517960a623aa2f7bc51df2218e3caca968", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239831, "uuid": "eaf8245f-0fb0-48fb-a332-759ad8282fe5", "value": "T11305BF3A32A24F21C24A1373C1D7490087D69A8726ABFB0B72C513D61D467FEDE4B697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239831, "uuid": "50bf2711-1904-47ce-bed2-259e816404cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239831, "uuid": "03364be8-465d-4926-9caa-6f41a04e30ff", "value": "12288:RjgH79dTu2nLNO1+NxTYl3ROTY2Q0To1WhCAOwyV5fsvj:lw7rJN0Exs3ROTY25TEAOwyV5mj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785239831, "uuid": "90b2d25d-c0e1-43c6-9950-f6eb9390fa27", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785239831, "uuid": "ffceeb3f-501a-4d7c-b985-0bfad1cf92de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239831, "uuid": "94cf20a8-7e69-49ba-b8e7-e7a2a90b3a77", "value": "SecuriteInfo.com.Trojan.Mardom.IN.11.87511552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2b31ca-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249716, "uuid": "93fd3a6b-f522-43db-8ee6-cabed15c3be7", "comment": "Malware payload (Mirai)", "value": "2a70aef730f89297251521a37661b6ef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249716, "uuid": "c2056ed3-8f4d-43ef-854e-c276f7f67dbf", "comment": "Malware payload (Mirai)", "value": "625faeed889e109b425c5f67be371e3e0c6d9b794ea8974e79b4c085aa896340", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249716, "uuid": "157b6a3b-7436-47b0-9279-d78bce363803", "comment": "Malware payload (Mirai)", "value": "f6ede868bb309f052a47045beda467b132a6f1a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249716, "uuid": "d3acb3ed-0265-45a6-86ac-dacbd02c4fe4", "comment": "Malware payload (Mirai)", "value": "33326351f319d1f1f7968df4658a8516ee1a14ffd4a7877514848ab11f6e46b51cf54038d25774873f8b55377b4ad64a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249716, "uuid": "0132d68b-28fc-4963-a068-2e9a2fb6aa07", "value": "T18943027F03B7B6F4D14A3CF41C089069ED54A6169231678F6BF54220A51364BBE12F1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249716, "uuid": "312ae405-46cb-4078-9471-3e0d57148381", "value": "1536:hKa6Canx+aIl/SjGO65cLdlSeWqGd2iRCZoVWPrMcSwa:hKznnHIl6jmcHSAK2iIZPQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249716, "uuid": "e5289e1d-e836-43f7-ab02-7a929856235e", "value": 58316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249716, "uuid": "e4a183e5-a0c7-4078-b878-c806c404b97c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249716, "uuid": "060d1449-59b3-4da2-9b6d-ac0e256ed379", "value": "zero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0da064-8aae-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785261634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785261634, "uuid": "8f19c543-73f7-4a12-a6e0-c41dcb1eabc0", "comment": "Malware payload", "value": "9126a8e00fe9a913ca49edb4a3224c82", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785261634, "uuid": "f1a2bc32-68dc-4076-b46c-31cb150c99d5", "comment": "Malware payload", "value": "6289f36d2b3589b2db489a9213ec465a55c77bc469ecee9217ba45e0c47de03b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785261634, "uuid": "bc56c0a2-d0cc-493c-b49a-df06d22f329e", "comment": "Malware payload", "value": "69019f74d621ef7c2c34ab7806bc66c6a103ff24", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785261634, "uuid": "8124cc02-3a2e-4e4a-8900-10732ca669bc", "comment": "Malware payload", "value": "46b18d5f10251be4eb30a2301e8e1df27e352e412728350054950da1ba3b50002edea3466e180cda833c85e70585cbfd", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785261634, "uuid": "62d19bfc-8a7e-486e-9078-44d2342702d2", "value": "T1FE3209DCFEE56270F31303CE37AB2926122460D72008C5C5FA4D9DE57F467D98627A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785261634, "uuid": "3bb209c9-da5b-49dd-9587-f300aee16337", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxz25JYb55qo5Hd8I74GthOO:sXX+/DV7k/325WjqQ884GTOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785261634, "uuid": "58dd1845-97e7-46b5-b2a9-47443131b375", "value": 11847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785261634, "uuid": "9cd6d128-f395-47be-ae8c-3638089cad32", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785261634, "uuid": "14a4e3ea-14da-4711-b8bb-a0535ada58af", "value": "don12089.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef88490-8a9a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785253104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785253104, "uuid": "646f2d89-cf09-4fc6-9f2d-236b726c2782", "comment": "Malware payload", "value": "30ad9c16fd02743ef9b03a6b871111ab", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785253104, "uuid": "f76a9792-9324-4a9a-8b61-bf886445ed87", "comment": "Malware payload", "value": "632acee04177d5c8b0e2905c9358b209b672d48e39ef274eb9940f5e15e68a2f", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785253104, "uuid": "afef7319-f4bf-4530-acd3-a9bf623598a9", "comment": "Malware payload", "value": "facde355d762019f610634d28920b6ad72e5ac88", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785253104, "uuid": "a862b125-8ec6-4124-b619-fc9f553528ea", "comment": "Malware payload", "value": "c51be7fa13a0ff7067b5d9bc817739b73fc0317e3d5cc7a667512b4b1f4154562dbec2002c5b94f49c0b980677ffd949", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785253104, "uuid": "ec7b0bb9-f8a7-4c6c-9394-7f9f9c5f9be6", "value": "T13FD1CDF00905D35361CE2D816F5129CB9130CBB317AC968B4C70848EB7FEC86A5ABDE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785253104, "uuid": "73006585-050a-4de7-abee-6a4afea088da", "value": "96:5rKPcvlRQEMsWaM+Ezkh2VcBUgbnIdUbixSGqiltBh7ATUrHod2OFR/8:FtRQaPEzkhbBYSdeF7ATUDod2Y/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785253104, "uuid": "5e202f3a-1bb5-4f2d-94fd-e7c3c9559422", "value": 6357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785253104, "uuid": "2ce74964-cfb5-4307-8b19-9a8188b7970e", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785253104, "uuid": "47757f87-33fc-4338-a951-ad5d450ebcbc", "value": "FQJXxkURfmpjGPlugY.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee255ca-8a87-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785245132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245132, "uuid": "ef5261d8-6a1f-4901-bf97-0f4f4c001344", "comment": "Malware payload", "value": "57857e9ae77c3b9968065beb24ac5b4a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245132, "uuid": "4cd8ceb8-ad3f-434b-8772-262ff52a9bc3", "comment": "Malware payload", "value": "63b1de793ea1bdd55537d2809defbbd053713923882bfb80a55e0e76422562f1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245132, "uuid": "eeb9ca76-9b28-4045-8da8-035159f594d9", "comment": "Malware payload", "value": "dd895bd8b71803a475827e99fa61cd6d1b3c1bbd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245132, "uuid": "5ecf6c71-3ca4-441b-a4e8-876343e619e8", "comment": "Malware payload", "value": "3a97354e3b54bf235d6d6eff220efeef21cc111e55618fee167841a203418118b764ab89a849dc398c94872bb6b978a2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245132, "uuid": "df67347a-45a2-451b-a7fe-eb4a476e30b6", "value": "T16EC27D966A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245132, "uuid": "f377f5e8-b096-4d79-859a-f2c8255418e7", "value": "768:z8vCB+25j6es8Rb9FYpMSUpi+20qUpi+20YQX:z8l25Jtd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245132, "uuid": "52fb3a74-5a7e-426d-9d98-2a3149c1529b", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245132, "uuid": "9f4cbc4f-5e58-4f1b-b128-597c4b32ad38", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245132, "uuid": "77b02702-4e9a-45b7-b1b1-de25ef9612a7", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e50f6fe-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220998, "uuid": "2968eaf4-1138-4530-8a1a-29efe9381f85", "comment": "Malware payload", "value": "64e00ef95fe4d580b9780604348c8e84", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220998, "uuid": "ba5d2498-4c3b-415c-92a9-e955939a38ea", "comment": "Malware payload", "value": "64386f4a191379843196c93ba2d349d52a081506c7385423aea00b5f4ec2ab9b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220998, "uuid": "0e28e55d-63cd-4241-aba4-e721ab1c5e66", "comment": "Malware payload", "value": "e34b63d2caa4e7a1cdc1afce4fe559c50684d459", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220998, "uuid": "6bc3e4d3-e538-4217-9c14-296adf8c810c", "comment": "Malware payload", "value": "be522ef542738e55cf5719d6925f0dcea7feb5a2fe62098fa61db4ccef521823d58dd3278a9d9289dd5e2add43e2fb57", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220998, "uuid": "88910a9a-924a-4db2-a45b-b12514e2ebee", "value": "T1A821B965D7B635C5D1B7EBB938BA7E2E3708C15205412287B6CB3AD787C69C06811940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220998, "uuid": "2e5ab431-e48f-4a44-835c-fb970c534fd5", "value": "24:9mukzPp5GETVqhosK+OhCskF8SAZOjM81Yue51Rg/yrj0yvvLiLTC1yBUoXukXzx:9rkzPpkETkhR70OjmbgqrIyvTivJOkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220998, "uuid": "38c5032e-f279-449c-b7f3-bda7dee2f58d", "value": 1431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220998, "uuid": "e94ea9ee-6b96-4903-bd0e-357009e2430a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220998, "uuid": "96209d5d-3bcd-453c-ba58-2e3084f15d7a", "value": "images_20260727_131914.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49237037-8abf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785268959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785268959, "uuid": "5061b630-0cf2-451c-93f7-424fc777bead", "comment": "Malware payload (Mirai)", "value": "8b32ae34689885f625ffb4d96d5d8d88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785268959, "uuid": "a0a2ca2d-de40-4735-bca9-46d9ed8d5009", "comment": "Malware payload (Mirai)", "value": "64904cd80ec7985ef0cefcb50e2c44fb5da42317c856f69b4a11d992f6631a58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785268959, "uuid": "40b0c376-1180-4c4f-9579-9c18beefbd14", "comment": "Malware payload (Mirai)", "value": "526456bbf0f4721ce3a410069a3e67bf41a132b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785268959, "uuid": "8f8ab3fd-cf2d-4f78-99ff-73013a9a54be", "comment": "Malware payload (Mirai)", "value": "83dc73de310159e554991fff7405c9223c987d3f958b01b4ac023c287b2c393a78b245d10650c7f35cad7a156c784e9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785268959, "uuid": "9fedbbe0-3129-4532-a51b-69101c5a02ee", "value": "T15214945E2E228F7DF678C33447F74A20976D73DA26E1D684D2ACD1052F2025E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785268959, "uuid": "cb5ec620-a00f-4c34-852c-d3bd72e0bced", "value": "3072:ZviBF3ROK55Moi/1Y4U9SOAKMKDRq7ig+nzW661DRh82LUlvFiElzK1STphnuqSK:ZviBZ37wYlvFHlkSTeqS5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785268959, "uuid": "3a7dde5a-ce1b-4c6b-8876-8586cdbf7c91", "value": 202068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785268959, "uuid": "e835bf13-4f1c-4f34-9074-50a3cc2fb836", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785268959, "uuid": "5a63c67e-e41e-4678-8fb2-7a1254338841", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f968958-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785224410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224410, "uuid": "219ae4e8-4de2-4236-ba60-7f1efc483637", "comment": "Malware payload (RemcosRAT)", "value": "30eff0fbbd41f9172813bd4907d68730", "object_relation": "md5", "Tag": [ { "name": "46-151-182-127", "colour": "#7785DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224410, "uuid": "650b6a6d-ee05-4ed1-9dda-e15f087a0d76", "comment": "Malware payload (RemcosRAT)", "value": "6599585dcd0455e6c47701e369283af406735c102a6bacaadace6947acc56d18", "object_relation": "sha256", "Tag": [ { "name": "46-151-182-127", "colour": "#7785DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224410, "uuid": "f615a084-8957-4c6c-ab89-ac5e482f6bc0", "comment": "Malware payload (RemcosRAT)", "value": "8698bc1b055be56dce1e2d1cb5634e399a31b1cb", "object_relation": "sha1", "Tag": [ { "name": "46-151-182-127", "colour": "#7785DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224410, "uuid": "eae0bb1b-b41a-41dc-b67a-c22b571d28ee", "comment": "Malware payload (RemcosRAT)", "value": "6d1ad7465500b7e6a8419a19a90f782cc551a82129ee72d341a29406e2cd55e670a9d657cad54cf0c71697078359624d", "object_relation": "sha3-384", "Tag": [ { "name": "46-151-182-127", "colour": "#7785DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224410, "uuid": "b2ec5ad1-9eb5-4594-99c8-6236a808ab96", "value": "T13DD47D4AA3A441F4D077C235CA828537E6F2BC056670862F13D74E5B6F233A15F2EB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224410, "uuid": "9078a37b-7a10-4e97-83ba-c64629e3ff94", "value": "0cc8e2c6f08a90a370d78009080edfef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224410, "uuid": "3753f5f3-0a39-46d9-af1d-a57b17a0af2c", "value": "12288:KZL8K7flZQP2MfAeWoqOKpqs3+Jt6eJcJYYoF5Zr:0QKjlZQuaVWoqVpqsuJt6YcJYY05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224410, "uuid": "2b69a64b-c87b-4ef3-9726-4936c1294b9b", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224410, "uuid": "f9864e9e-d706-41c0-a370-981c62034878", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224410, "uuid": "947777da-76da-4e82-8ee8-6320708af46b", "value": "6599585dcd0455e6c47701e369283af406735c102a6bacaadace6947acc56d18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75354ada-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249706, "uuid": "a0a2525a-6753-4175-bb5d-86c0e81694b6", "comment": "Malware payload (Mirai)", "value": "99723f4267ab03dac3ea5e09302f81dc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249706, "uuid": "04036af5-fb1f-44c8-b489-52e6dba9628a", "comment": "Malware payload (Mirai)", "value": "663728541ca9cdc8753b72d845bf33324f3f79a442dfc2c49ee6b42402e9d001", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249706, "uuid": "4faaef4f-eb0f-4412-afbd-ac88b8887e00", "comment": "Malware payload (Mirai)", "value": "7b2ab207461d4926ca2ed9abc8e202a0d9f2eca0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249706, "uuid": "ba00613a-e023-416a-9ec7-6ccb5238e0f5", "comment": "Malware payload (Mirai)", "value": "9f9ce13096bc0d4e64f6c00ec1b12bf8401cf2769fb0239bdb47d818c17f845d68723f2bf0b0519be43b650891d4ddab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249706, "uuid": "b2050522-9325-4857-884f-b1c4a61c9ec6", "value": "T1EB7302D054562D89DF0C9C399460C48862DB7AFA44AFC91073B839E8FE8C9F29E1BC61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249706, "uuid": "1b97d84a-21e0-4979-b33b-51d66830912f", "value": "1536:xyyU33jh5SI46oWqVDk6kvQJw7/9gobnLFF8MobqkVIUHN1PSQrC:ijvtAWq1MvmEBbnLFF6bqOte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249706, "uuid": "f09e66ec-f016-4b1c-a987-22c2060c927a", "value": 74612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249706, "uuid": "626d19c0-513d-4400-b72b-80e49e806e97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249706, "uuid": "6bc24905-b2b3-41e2-8f7c-f7273ac763cb", "value": "zero.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d46c23e-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249773, "uuid": "3a1694cd-4a21-4b52-80fc-c6966897fb35", "comment": "Malware payload (Mirai)", "value": "03346be444b1497913d120def88eff4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249773, "uuid": "7aba6976-1af6-4036-aeb6-74503bb297a3", "comment": "Malware payload (Mirai)", "value": "6671e5f634e790e044d48825df44e28a95221bdbc618417ee9516f1c2ed19525", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249773, "uuid": "a4c505fe-0747-491d-8745-957f9ad1f7e7", "comment": "Malware payload (Mirai)", "value": "c255cc77f887de32bf83d6e21e947ce953690017", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249773, "uuid": "b4cbaf80-9cc2-446a-a8fc-c98fb99d3a3b", "comment": "Malware payload (Mirai)", "value": "e78bddc01a6b806e7367a9d3fe4964e58f0418eff9c6146467e7abe051afa7ed69eeb7ce61d6b3887935abf81ba1f82d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249773, "uuid": "9c66f8fb-b87a-496f-803c-c809517b631c", "value": "T1C7144A99FA0F5D42F1C7D3FCDA4D8BD13A2331E397768AB62D0202EDDAA79954950802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249773, "uuid": "76c04e82-8866-4836-8f75-9245dc430e98", "value": "3072:zkKPx1hVSRxwjaJDbZCDBYJSIrGqJi4MyS7IpllgqiBnM256Lq:DdE6YJSIrVi4Q7IrmBn96Lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249773, "uuid": "f6cdcb73-9786-4035-a767-a18295d8694a", "value": 190344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249773, "uuid": "b8c91f97-d498-44de-b6d2-52955d8c9a5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249773, "uuid": "871bb6a5-511b-4925-8ebb-9e666469ccff", "value": "zero.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb641b02-8ac1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785270010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270010, "uuid": "d887f117-4041-4de9-9263-f582516e832f", "comment": "Malware payload", "value": "dc8656d5372f7aaef67d2c8ecdc1a20c", "object_relation": "md5", "Tag": [ { "name": "103-193-173-83", "colour": "#A458EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270010, "uuid": "2b268193-3ceb-4a63-814b-b2f539df8111", "comment": "Malware payload", "value": "668c0851af5a3a1f685f3e632e4cce3f71aed73808deefe4c5b59bf40088d4fa", "object_relation": "sha256", "Tag": [ { "name": "103-193-173-83", "colour": "#A458EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270010, "uuid": "8ee34362-7eb6-499a-a09f-ce1d41e1f00b", "comment": "Malware payload", "value": "f857f8c6e71d93e73f9846a793005338313b1380", "object_relation": "sha1", "Tag": [ { "name": "103-193-173-83", "colour": "#A458EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270010, "uuid": "1dbf85b2-c4d8-4f64-ad04-6162dc936137", "comment": "Malware payload", "value": "5ad504d272dbe0d82c43993c45c66ac8780dde200bc3ca9f6e1ba6088f7cdc3fb4de820ccee47cf396a65251afe53ebe", "object_relation": "sha3-384", "Tag": [ { "name": "103-193-173-83", "colour": "#A458EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270010, "uuid": "143f8212-feb0-4d63-bd9d-f1a5b2e71922", "value": "T1F292E74FEA8A18ECCDE7E2B8D4E71B31E9B179180569B77F0714C0766D22E45E5BC220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270010, "uuid": "81b3987b-360b-41e3-8713-51164f05ce7b", "value": "d4434b8b9fc94456394b657184fed035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270010, "uuid": "2ded0fd4-1c3e-4478-a17a-e519fb0c1899", "value": "384:QSf/S2y46GmxTIicuVPR8F7RmckVPxIiTDTjUlW8EBW:QS3ohGmxTIicuVPR+RmckVPxIiTLyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785270010, "uuid": "84673102-c04d-4769-b5c6-a89006a3ac81", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785270010, "uuid": "5ee2d7cb-61df-4d46-a329-231b2bf80ae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270010, "uuid": "daf67516-4bd5-47da-a134-06caf025518f", "value": "version.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da25b85-8a1a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785198126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198126, "uuid": "c9c163cc-35ac-4bf6-ac52-c284a1f316c1", "comment": "Malware payload (Mirai)", "value": "56321a369e41ed8a8dee9a4c631581fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198126, "uuid": "334845c8-567d-4ffe-8513-0a30034934e6", "comment": "Malware payload (Mirai)", "value": "6736fac25a0bccf4862f4a49bb354961a042e0c420f081332ad4473eb7ed1e8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198126, "uuid": "c7b128ad-6a8b-4f83-91ba-e5ad85d9b71d", "comment": "Malware payload (Mirai)", "value": "95789eb4d06b22cd450fe01c39e2a7a6f3dd6c16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198126, "uuid": "36f74b9c-68ba-4296-8cd1-65039768e061", "comment": "Malware payload (Mirai)", "value": "d677460a3e3d100fbdfc7ccb1173daa3aecca795bd5b02a7acc0f3727cb9f02f25c5a34159b381726765a92cb293b1a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198126, "uuid": "09207dd8-36f6-476d-936b-044371120f5a", "value": "T15C631A99F9819A22C5C115BBFF0F828D77365398D2EB3307DE196F21368786B0E2B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198126, "uuid": "c15c91fe-fa20-4c1c-a62f-5e4d9dd5465d", "value": "1536:ylwQDZIVSvZAdm/z6yHG0TLE0mbzLmO4SQVDCW6atfn5ZLCBRJ:QZvZ4a6L2w0mXaVhHn5kJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785198126, "uuid": "7a7dbc48-1c45-4480-8a97-12cbf14e6d62", "value": 70796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785198126, "uuid": "50a9eba6-4990-4436-967b-660ff56a7208", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198126, "uuid": "b34b6140-ec2b-447c-bfeb-4d50ad1769ac", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2f3a6f-8a9f-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785255413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255413, "uuid": "83c8aa4c-043c-4d20-819c-048412304400", "comment": "Malware payload (CoinMiner)", "value": "5a0d8566ca1081047d435f1839a9577a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255413, "uuid": "f3852229-a62a-4869-a4b7-428bea69ef45", "comment": "Malware payload (CoinMiner)", "value": "679a9028729d7ce6177c78ed0a4607194343c1877abcac6a8552c8085066dc41", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255413, "uuid": "f0d4327f-b047-4c10-bd00-3f3e3ed67ffd", "comment": "Malware payload (CoinMiner)", "value": "746f9ddeab749a03a9098de8166fd9d582ade513", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255413, "uuid": "f682fe63-74da-44f8-b8a2-517853819ac8", "comment": "Malware payload (CoinMiner)", "value": "94274e5647dbc071e7393e43bbcbd579976a892fa2a96c0603e069eb9468fa1165528a17207b4877dba83d17b00e0cbc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785255413, "uuid": "cc1a2302-df63-415d-910f-c57a1bc80c61", "value": "T14432921D6E4B0322EE5144B4E475424A543D1EE3B747EBDBE633D1DB4AC6E8488C0A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785255413, "uuid": "0707ba0b-00db-49c1-83f1-ae4c8f390c89", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785255413, "uuid": "a29a327c-2698-406f-9b92-173a46171677", "value": "192:woFeJIS5BHHxSHO8H5epPFJxTEZmFhqm:wogJDHsueepPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785255413, "uuid": "3c2c85d0-a0ec-4c42-b791-77c92a1f7785", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785255413, "uuid": "cb1fdb3f-a213-4531-bfd0-43994de2d329", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785255413, "uuid": "dd4f1df6-69df-4716-af7e-90bf2ba2d607", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761ed97d-8a8e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785247989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785247989, "uuid": "89da48ca-bc19-423b-aa05-a6c7e31bf995", "comment": "Malware payload (Phorpiex)", "value": "ab96159be2090be87021bf5ec7cd96ad", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785247989, "uuid": "7163b1dc-00ea-41d9-9968-64ae8ce187d7", "comment": "Malware payload (Phorpiex)", "value": "6936c872fc55301340ca5e2575216688f66c0c94888072d57cdf53e11167eb39", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785247989, "uuid": "d18e7d73-22b9-42ab-89a7-7dbad7d359c3", "comment": "Malware payload (Phorpiex)", "value": "c17a480500ab2bf301c3c52f2a7fb824140f7a73", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785247989, "uuid": "3607cca5-e6f2-4ef1-85d9-8b2b9183374e", "comment": "Malware payload (Phorpiex)", "value": "d43c342e3f46df8442dbef71fd8d5d8d1ad3003ef998101e5151586a962bffdc98dd2991cebb504ab0e3df5ae9978532", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785247989, "uuid": "be782402-642a-4ce2-971a-1e9a25839b5b", "value": "T119623B0BB8808036EBE04475827F526648FEACB623D4F8D7FBA068C959B46D1F43516F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785247989, "uuid": "1c55b10e-7d48-4249-9f88-5bce1f45af50", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785247989, "uuid": "850df8de-912d-43b1-9aac-aed55ab64344", "value": "192:AWUsGnjXgjk8LcRI+AxOsM9ofpF5oIV5ixBKUSf0zQA8FuixgJxTmv8U9cth+R9X:A9ScxufproKn0t8Etav8U9c+LX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785247989, "uuid": "03738b65-e635-41d8-90d8-991d4af35856", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785247989, "uuid": "701ecd9d-270c-41b8-82d0-0ef4ad6be8fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785247989, "uuid": "5ca370e0-b65e-4d2d-b58a-7ea9cb408bfe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f21c981-8a1a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785198129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198129, "uuid": "b5561be7-832c-46a8-9552-7cc4625ed9c1", "comment": "Malware payload", "value": "df0a704dfb896d3815a957fa8e24d571", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198129, "uuid": "4828a1fa-c736-4876-a008-e80d2b49cbe8", "comment": "Malware payload", "value": "6956260708076c10bac1e5725846780bc1a754fa1a26001b4b8f22b8c1a7c1fb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198129, "uuid": "d9893b52-f1a4-4fd7-a622-169e68a25c30", "comment": "Malware payload", "value": "5e3d7e74ed4d6c48ae1110847f59efe03f641896", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198129, "uuid": "a5505b32-659a-498f-ba0a-af8c80420778", "comment": "Malware payload", "value": "4d414119d31326c3f69ebb2600447c3ad4e4d47992484e0889d01f96ef9473532efbfb80a8a27bb415c6cb71e7f4421b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198129, "uuid": "0af736bf-43ed-4ef5-9450-4c35b4331093", "value": "T1B801ABC6922055A04029D52D62965294F431C3CA59460B787FCC943DABA8A14F026F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198129, "uuid": "216ea221-e858-44ca-9f3d-24bba3a2ebef", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkazCt855Uk97COhOClhDuzsqC6OQsRCzauD:kXCKysE2hi0ziQvZohazXUwgauNpZSi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785198129, "uuid": "0d030517-3e84-4d6c-b183-b50f302102e3", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785198129, "uuid": "35813e43-a11b-4669-95d1-a5d359ab669a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198129, "uuid": "507898ac-b6c6-455d-b523-8430f1de5691", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860fd422-8a48-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785217951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217951, "uuid": "5d97a264-1fba-4463-978a-4bd6ba5e3576", "comment": "Malware payload (Efimer)", "value": "78e063c23731705994a1b23d5375f3d9", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217951, "uuid": "ea700488-d3e1-4879-b2a4-985409b6d0bf", "comment": "Malware payload (Efimer)", "value": "6a11fdf8efa8d65257b58f265c43aa937efdba13953abc99203ab3b30c96a8f0", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217951, "uuid": "ee47592c-4f07-4d36-a81e-3b3cc9bfe3b3", "comment": "Malware payload (Efimer)", "value": "cef1bf8fa5ace7daab830344d9fc638828e3dbbb", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217951, "uuid": "bfea8524-5dc3-4826-a82c-c4c94fe24f9a", "comment": "Malware payload (Efimer)", "value": "9e22abca77c18f17e04486312503a4df3be4e51acac26507220a51b34465183cd75814b73ad47f05c7a99476da7f9b7f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217951, "uuid": "b9ab8eac-fc58-4184-a17a-5c43d3bdbc83", "value": "T17FE6330CAAF001FDE6B710BCE9F153A1D56A342E57B2C98F675082625D672E08D3ED63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217951, "uuid": "6ff77ea0-e775-45f9-98f3-ef51e905a710", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217951, "uuid": "54962121-caa6-4e17-9557-151da6a9e707", "value": "393216:FvIJbPjsUjf2KlKeXMCHWUjX8cuI3/PGTAI:FUDljfhgeXMb8XpH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785217951, "uuid": "c41c4b0b-d632-4cc9-bc60-f8e157ecb3dc", "value": 14283616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785217951, "uuid": "05e71708-c7bb-4507-9eaa-684c48c3c8e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217951, "uuid": "b2ed96dd-a643-4af5-a950-70b7524ea9c4", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19374cf-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221057, "uuid": "ed493fa1-7edd-439d-8d08-255bef378f29", "comment": "Malware payload", "value": "e712a8eb10b33bd5cd38ca1a4dfcc19f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221057, "uuid": "dcd96ed9-9e6b-4d01-bd5c-8f78570a235c", "comment": "Malware payload", "value": "6b5cd591d78f3409531d001ff50f998a21862e651fbbfe0d584b773a88c9c285", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221057, "uuid": "eec69ed0-d00a-4804-8479-05340ffeebae", "comment": "Malware payload", "value": "2dbf2f9749bb5bdde03846141008938fae3ce1b9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221057, "uuid": "f102efa5-d647-47b9-b137-1c80e36a6a00", "comment": "Malware payload", "value": "dd4a1a87901088c0e45be695a889917e5ba0709686cb4bddc50e4ab1e5597a24667d4b0c0234cc1fd1aefd7c95da1cbd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221057, "uuid": "37a47583-ba5a-4f37-8e59-695ddcbeaa29", "value": "T16152C027CD8DA918D28A82A7FBD1B1ED89FD37B5851D8C0C39894BC9D33C06A9C55528", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221057, "uuid": "296f9e66-2a09-41ef-b977-0a3688cc32a9", "value": "384:OyaR1Q9CICfTC/fffSwrOCROMzqvwkoMNQ:x0+CrTAHPrO7owNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221057, "uuid": "48caf60a-5681-4147-83a9-ebf5923aec28", "value": 14100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221057, "uuid": "3df98a83-3ad8-4d47-8d5f-7125da51ddc2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221057, "uuid": "b8976ee4-2ae9-46b6-8228-bf6e7d2ad36a", "value": "images_20260727_082538.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b358308a-8a91-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785249380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249380, "uuid": "84a1f0d1-aad7-439e-988e-36834d40a5f2", "comment": "Malware payload", "value": "fd4f205d91d6c81e7b7728e3bda42b97", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249380, "uuid": "0b54a5d0-b815-42fe-9761-c585c6e81dbc", "comment": "Malware payload", "value": "6b722e265cf3a9e6071e871583c7ba22f721f3f36e4086e46539678badd6dc81", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249380, "uuid": "6f4d83d5-9b85-4dcc-a9a1-9b7b97e2e22b", "comment": "Malware payload", "value": "36518f5eb70979a7a406f27cd27ce4a924a8b738", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249380, "uuid": "422c0400-b034-481b-b629-5dc143b2be7c", "comment": "Malware payload", "value": "6b272a5d685c2ab4f0985fd5c8f9419ea8316332340b122226e03840e91069519b20c38e8c26cebcb3a1826869d72276", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249380, "uuid": "3cce38dd-97bc-42f8-b520-a73472f0f037", "value": "T191D51C494B716EEDFE3497916E3CBC0BDA7122E89E63428EF11378C5E8AE0E45714076", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249380, "uuid": "2ca48ac1-d8a7-4930-af72-d93abc7c2326", "value": "768:LHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHx:Z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249380, "uuid": "69819c1f-f261-4973-952d-24b7e53ac281", "value": 2815043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249380, "uuid": "5b7639ee-9e36-4b99-8c4c-82dc344875de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249380, "uuid": "27634e8c-7e3a-4f78-95d7-72f813261dd8", "value": "Slip-01.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c648b693-8a9e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorphiex)", "timestamp": 1785254996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785254996, "uuid": "6fc71c30-a32f-4562-9ba8-6c12f0164172", "comment": "Malware payload (Phorphiex)", "value": "33dbe6464c260480fe018c5e09a32df1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785254996, "uuid": "a627635d-9ce8-4dd9-b1de-64d0d2c7d313", "comment": "Malware payload (Phorphiex)", "value": "6bb93285730e63fcb09bc3db2bbaffedfd21227f648c3c7cfa2ee347f75360f0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785254996, "uuid": "6ad680a2-5110-4f34-9b4a-a8b9c8b457cb", "comment": "Malware payload (Phorphiex)", "value": "72edcf1d674c9c4cbd441465f670495bc38a172e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785254996, "uuid": "7054b1d6-6580-4fba-89fa-fba81d5c1d9f", "comment": "Malware payload (Phorphiex)", "value": "14e95b4d35491435cb4128375058cb49676cf2f7fb1fcfcf96d47ff198733c48cc25fce164fc74be886e766616044fce", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785254996, "uuid": "ee4e8161-02b6-4912-a76c-c7d8c344dd6e", "value": "T10C623B0BB8808036EBE04475827F526648FEACB623D0F9D7FBA068C959B46D1F43516F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785254996, "uuid": "7e3fda01-1ff9-4685-b110-fd1ac9d1627f", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785254996, "uuid": "4f41098e-31c0-48c2-9e51-dcd1a12eea1f", "value": "192:AW5sGnjXgjk8LcRI+AxOsMhofpF5oIV5ixBKUSf0zQA8FuixgJxTmv8U9cth+U9X:A0Scx6fproKn0t8Etav8U9c+aX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785254996, "uuid": "dbec0f66-7dc3-4bb6-8770-15f5f8ed1ccb", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785254996, "uuid": "0ae6dcc0-a4f5-4966-8422-4220c89529a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785254996, "uuid": "18edec3b-93f1-462c-aecd-3c2e1f5b6763", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d2ba45-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220789, "uuid": "4133eed7-502b-4839-8828-3048d2ca9087", "comment": "Malware payload", "value": "e051dfaa2c46c4e9e0a0da22f8f088bc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220789, "uuid": "3f27718f-3245-40fc-a25a-97bb6cedbfd8", "comment": "Malware payload", "value": "6c08a3a31b8533e26f4866b7a3172fbc02f9f8a98a3bb24063a7c6e42d7f6c57", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220789, "uuid": "86ef0923-50bc-4585-959c-a84efa70d563", "comment": "Malware payload", "value": "5b70efccee95c74e1c5d2ae97caf19d2e0cab0b8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220789, "uuid": "a92112eb-7d97-4b07-8d1a-3f4e8fb31073", "comment": "Malware payload", "value": "393decc351289ad7853efb2b29dbd0a0879efb72ecba1438b6a17335ee20c40ff87b26ca4ec187aa2bd005c3fab95d3f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220789, "uuid": "e9440871-ca70-4c70-a198-78e1b65f27c2", "value": "T1C7B18F1060139125F15127ADA7F99CB94D4661077FEFB311A59D4A4F6844131825F4FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220789, "uuid": "1c316cdf-6a5a-4f53-94b6-fdce84f75106", "value": "96:pQmPdU0RVjvYjIAR4Ti5/EhWdmVobh9QKPEZdz3Vb36UNjfK83P6NJIUQnSf:p80RVjQsA6TuEhAko19Q6EHzF35NiKPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220789, "uuid": "533a80c4-b815-48e7-852d-70c8846fbdf0", "value": 5297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220789, "uuid": "7e1859ed-2113-4de9-8d25-5c54dc0e339c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220789, "uuid": "337c371e-fd2a-40be-81d9-af4bfcb0a2a9", "value": "images_20260727_214103.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6e0866-8ac5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785271458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271458, "uuid": "fad557ef-783f-44bc-87f5-6f8222d3a13c", "comment": "Malware payload (Formbook)", "value": "1bc85fa0861e29220ac221302bcd4fe5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271458, "uuid": "b6f8e476-f9e9-4cc5-baec-eb956f8f4f9a", "comment": "Malware payload (Formbook)", "value": "6c1abc6c731f272e22deabeeb92b6378fdc32507a1fac93271b45a2a577aa88c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271458, "uuid": "4bbbe1f9-9eef-4db8-b321-c410bbdc1b5a", "comment": "Malware payload (Formbook)", "value": "f04d5be78e3d6f33e12a53f1dbb17033a51e2116", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271458, "uuid": "f87bd149-e7c2-4ee8-9a72-7a8d6b8fa702", "comment": "Malware payload (Formbook)", "value": "d17e92521f680547c438f3fa65474b354d1a54d8cdcdc3d0704b11906a1e43f280c585a4b7507556ed66b849837e1689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271458, "uuid": "d1bdbee5-db14-429d-8e0a-1ed80a587a4e", "value": "T1A716E8974F544A9D55ACC76CC96EEB484B7D120B033CAE0E3BB938D4DE56FAB104C09A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271458, "uuid": "ed4b0abf-6025-48e2-84db-a846ab110a0b", "value": "98304:CMq69t2ynXIkZt/n4Ynab8USlsH7dX65iAM83i4M8BFdz7:kqII4oab8US+dKXzi+z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785271458, "uuid": "e517f145-b48d-4af7-b98a-58c5cdecfed0", "value": 4151392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785271458, "uuid": "41caf8c7-1526-40dd-8b5c-ecbed04c11e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271458, "uuid": "ac41a7cd-6950-42a4-b76b-7f2f2ed51068", "value": "Quotation.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a34de9-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785224277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224277, "uuid": "d10779e7-1122-4a84-a36a-269b811c4376", "comment": "Malware payload (RemcosRAT)", "value": "1bc3e0e2470cc9fdc47bf27c032ca13b", "object_relation": "md5", "Tag": [ { "name": "46-151-182-127", "colour": "#7785DB", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224277, "uuid": "6d7f0da5-f979-4b07-9d1e-555b6b268e32", "comment": "Malware payload (RemcosRAT)", "value": "6cadbd618d6aff59b5440edce3fe8ae2cea8ac58a4f85ea513c9431b835d5b69", "object_relation": "sha256", "Tag": [ { "name": "46-151-182-127", "colour": "#7785DB", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224277, "uuid": "ae574a71-e642-4495-a13f-3fafdf698484", "comment": "Malware payload (RemcosRAT)", "value": "031b49889af7297017426ad40520bd2da014ca23", "object_relation": "sha1", "Tag": [ { "name": "46-151-182-127", "colour": "#7785DB", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224277, "uuid": "f7550e02-f072-40ed-8a82-7d9494328538", "comment": "Malware payload (RemcosRAT)", "value": "95fd88c9464cbd66e0f8eba5ae7e491f1b72cfc9ee8e3b7eaec215f5c537ca23c518db33bc985522a114a250881c4d03", "object_relation": "sha3-384", "Tag": [ { "name": "46-151-182-127", "colour": "#7785DB", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224277, "uuid": "50efef3e-b643-433c-8270-33f8a11a3204", "value": "T1AF67D64A44B58B06C0F4E8C76BDCEAE9F6B8922F841077C64DB3915CA654BE3C3D8356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224277, "uuid": "5513a35a-037a-43e6-9f33-94159fa0d6e1", "value": "192:zyjRTfTq9TnJVUiOJhRMjSym7O77Hj5pNqRa5+Sn5S07qmJiQxa+6IIl3na07qqz:iuqkbtt0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224277, "uuid": "15c7a897-fbdf-4b06-9137-9acbdc9ff2cd", "value": 30438014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224277, "uuid": "c1ce6670-6d8b-4a4d-a901-47d28c86a986", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224277, "uuid": "ed1ad2c9-c07e-4d50-8922-df8ce3aeb44f", "value": "Dhl Invoice MNLR002855244.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7091cbe2-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220922, "uuid": "fafa4f54-998b-4bff-bca0-3f4afd34ae67", "comment": "Malware payload", "value": "ebbac374bd345461111eb3247625f714", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220922, "uuid": "ba039f06-1149-4a30-9683-bdb37c6b5b11", "comment": "Malware payload", "value": "6d4e6fb390195db91c266ea680cd97508b7688345984e84affcad6587179ba4b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220922, "uuid": "91e2e2c8-9f2a-44c3-8554-3e043d3ebf0d", "comment": "Malware payload", "value": "64e8af253702721c7ee944883d5593621616b979", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220922, "uuid": "c714f051-e736-4a25-b29d-9da44055227a", "comment": "Malware payload", "value": "513fb78722dd3a33fc63946004f1d8ed4d3eab370759c2904152b51975ca725731eff92d3ad07d3f25205594f65d7055", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220922, "uuid": "c7a00f0a-d6e5-4f72-a26a-9f66d6227062", "value": "T110E1BFEE58BB1404E5C1F121B9FD22BFC01CD488E49613915EA9B5EC3222F10ECC559F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220922, "uuid": "2d16eaeb-3350-4da2-9092-2390f72286c1", "value": "96:Gjr2fG6GL87PP2lYOA6LkbBHLpgMbN8+mrNXRCvIrVRXdc3wPZWlFKTbh86OKbQs:oKBPGYONLkNHLpgMbNn9gt9xV+6ZQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220922, "uuid": "2c3a52ad-f94e-4781-8b73-ab7e9b1a3f43", "value": 6832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220922, "uuid": "f5b10e76-054c-485c-9785-826f61c1dcbf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220922, "uuid": "062e8db9-95e2-462d-bcb4-8ff6efb801dc", "value": "images_20260727_085104.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b6486f-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220986, "uuid": "3ddb4886-cf16-4362-a28e-cd24051954be", "comment": "Malware payload", "value": "7f89e3bb1d267cd292c3d2531f0a4180", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220986, "uuid": "7836e357-f31f-4a81-bd4c-3d1ed0433d27", "comment": "Malware payload", "value": "6d73e1d61895a4c891b01ddbcd8033a91ce94813151e94816d15115937d3b0f7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220986, "uuid": "5ee6f8da-6d03-4526-9d12-af39e455cd96", "comment": "Malware payload", "value": "4ba4d6ed7c50f11b0c041647a5833cb1443c472b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220986, "uuid": "2ce6ff17-7a80-48aa-bb52-dfd8e4568741", "comment": "Malware payload", "value": "a6882fedcd476d259b700220b98b58315d20922c1ac9f621aa30f2ccbb0d4667544f859e3682cc3865fdc3b19feff9ef", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220986, "uuid": "dff03fe1-baa4-4ca8-9092-1067757075d4", "value": "T1F1C18DB6498FA6DCCBDC5975BAC7E04E81A801BEA3806317BB3D00E34CC513E11A654E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220986, "uuid": "02b8580b-a958-4410-909f-fef512c8295f", "value": "96:xSvHe3xTeuxDY3p1MGWyDo3R6OL3U0Xlyoc6wJ+PweflifhlUNiqPn02Gy/b:xSixTeu6nMGWyo6a3hTc6wJ+dchlUn08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220986, "uuid": "c0a55bf2-11fc-442e-aa99-13a6e96942d1", "value": 5812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220986, "uuid": "81df0017-cb65-4a75-9e1a-21ca32084d34", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220986, "uuid": "5f9e890c-e5de-4efd-9569-3964f4d1eac3", "value": "images_20260727_183618.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1833433-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785224440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224440, "uuid": "46682f00-8463-4d4b-9aff-da9e22ff503d", "comment": "Malware payload", "value": "77aa4570b97d91c74ace4fafeda5dc0b", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224440, "uuid": "c88354bc-c089-4445-9620-b0466943c1be", "comment": "Malware payload", "value": "6e4be0a1cdcf456d9278f9f66ea6231f344360af308f00c709472b2dad9c0d0d", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224440, "uuid": "b7bd82ab-7a5a-4f6f-aef1-c662b485a70c", "comment": "Malware payload", "value": "3fc0311803be3b33883361ba33e37a91e58a3b77", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224440, "uuid": "0f075a42-c362-4ba8-aa90-ad5e7acf9576", "comment": "Malware payload", "value": "2cef39f914f5f491e37f19b172b38be52a866515103d410ee5960b6710e51427023f1ddc14a7287d9602e89e6ba62694", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224440, "uuid": "3d613109-c39e-4fee-8db1-bf48ecbf2548", "value": "T11B5533D6F47A9392FB21CD716628BA5A0683731214A061A5D4CCC272F9F4ADEF1EDC0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224440, "uuid": "be86ab20-e8f5-4ba4-b675-ba768805b10f", "value": "24576:wSRfGnyltl2wWs4Yzs/6qty9LXTenG5w6PV/fkL+rPMRIzC6t9VWmEIF:FpGnyFWsX13ljen+PVFPMRaJD0mEIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224440, "uuid": "9568b814-2eb4-422b-b33c-a4c222beafae", "value": 1368572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224440, "uuid": "fe6e9099-5fda-4e81-8122-ee6aae4753c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224440, "uuid": "d0c9cd44-8304-4aaf-9fa9-9e3dd98b591c", "value": "zswap_shrinkd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f39c99c-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1785224409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224409, "uuid": "2b3439bc-eb2d-497d-bdd6-22b0943a8c95", "comment": "Malware payload (DDoSAgent)", "value": "273aedd246802bf702783f2391e786d8", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224409, "uuid": "3a1c0008-edb2-4a88-9893-53d2f7ddca54", "comment": "Malware payload (DDoSAgent)", "value": "6ebaeef174f266e310ebaff733561f6f588f236b7cdabe72a5cca895b77e9924", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224409, "uuid": "3bc1a781-e43e-4b3d-9924-a99fe58ee5cf", "comment": "Malware payload (DDoSAgent)", "value": "8923a097be23aebc7515256f5852bc8a0c9b7fa6", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224409, "uuid": "2e310254-5a5e-4176-ac8b-46c5030546ff", "comment": "Malware payload (DDoSAgent)", "value": "6ba6bbd01f19fb29b46e845ca7f495e271d1d418f22496a42913ccd36255673941d29bad0fb4ef1cf6f6606cc1f635ab", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224409, "uuid": "c9174621-ca57-4446-865d-95595a5ef040", "value": "T150266C81FB08E126D98B0B324C630B70B3515E42C2E5899F5319F76F46B26FA994FED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224409, "uuid": "dd86a350-8a86-4684-8c26-47b4441a4093", "value": "49152:mUMIagY+ET4Vq/Lr0A6br34cE3H3oIrt5E/:qgY+ETv8A6cTXoGjE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224409, "uuid": "a706cf48-e5c3-4fdb-a25b-7973ec9343b1", "value": 4653204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224409, "uuid": "d2f8aede-0d2b-4da9-ae56-aa208661c0a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224409, "uuid": "24a72301-aa15-42f0-89bd-1e7b9eb9be0f", "value": "devfreq_wq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122d8eee-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220763, "uuid": "dcf73e38-3ce0-4dee-b227-ea23c0c51486", "comment": "Malware payload", "value": "eab33b8fcc65219b982ab6df37916d81", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220763, "uuid": "294b9a1b-3036-4496-bc3c-b12fb45cd222", "comment": "Malware payload", "value": "6ed163276189be38d6bbabf78ffa9ce46304d1f4d1394a44ecf7f976a9575a1b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220763, "uuid": "fc48ae89-72b1-426b-9076-c654f0a65f32", "comment": "Malware payload", "value": "7f4ac8770c3caab22ad3a6a92106a3d185f5791d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220763, "uuid": "2d1c447c-08eb-4260-bda6-90217bd3b018", "comment": "Malware payload", "value": "dd5cfa8c3d347c8766015e2db7c6ff2b3aadd74d49c0f75667dee68f84a462cb0e6ac91778cbfbf4aac57fb5e1199d78", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220763, "uuid": "dcbed744-c053-4a4e-a62f-9822cd5d74bb", "value": "T1F972E034D4C89869F43236B235B919242FF47EF93D93EE812CB4524C4D3BCEE196206A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220763, "uuid": "2e56fd17-e146-4e97-a354-c6ca68897143", "value": "384:sqDmiqWgXB9+RuA4zsEIEGAodKeh5LkQzz5K2pLBJQlTcHho6mXX0OeXC:xEeuAtEnRodBN3zNK2p9elTcHy6oX0O9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220763, "uuid": "9f9a86f9-8e32-4003-ac85-0798d9203aba", "value": 16524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220763, "uuid": "b0e77d90-8f1c-4186-947b-c289eb37bf74", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220763, "uuid": "e47f841e-b106-416c-814c-47749f129496", "value": "images_20260728_013844.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdaa38d-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220994, "uuid": "e7d2dced-aec4-4c1e-82ec-25b24db95c5e", "comment": "Malware payload", "value": "09d15c4a69a01d8937d4b3fd1fd3d6e1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220994, "uuid": "73ea4bbf-c6ed-4f0b-b65e-63497834d144", "comment": "Malware payload", "value": "6f12eff294d3193aa7acc64a95cb073320fea330c824952a7800725f185a4018", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220994, "uuid": "80c5f8f8-fb81-469b-9046-32fba321c92d", "comment": "Malware payload", "value": "10bb221b6aeeba7e6b8d716ca023d35197197f8c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220994, "uuid": "e17952f8-5774-401f-a912-adb2732e75b9", "comment": "Malware payload", "value": "6f6250756e05d4da8a548f71fb9158c52970a3345f17e50d350d5be3778e5099e63b5018948446f01664decc7556394a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220994, "uuid": "e5d158bc-d472-4769-b42d-64b685ad64c8", "value": "T16141F8A9CD259B63C473D4706B76532C93BFE4B60A258C458B8407A43BD1B023BBCC98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220994, "uuid": "1b17c912-80d0-44f4-9127-e52a7c9a78d0", "value": "48:9HbvaVxCYSb3RC6zWLpeD6E6v8ETZwBU8CDxf19DCH2SDZB/Fn7O2L5XYyx:MzIlOs6kE1wCJFH6/ZL7R3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220994, "uuid": "86810cb9-3661-4655-9b14-77faddafb7f2", "value": 2420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220994, "uuid": "39ed30c3-6b27-4e8d-9f58-6cb876c0489d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220994, "uuid": "4edc6d16-d2ef-4f14-8b58-b9a9216a3511", "value": "images_20260727_071705.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe834a43-8aa9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785259814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785259814, "uuid": "1b51eee6-096f-483e-9482-a161cc694f34", "comment": "Malware payload", "value": "155d6deb8c9220a1ad4e4092346895f5", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785259814, "uuid": "1d37be64-ee8e-444f-8167-4e3947b30132", "comment": "Malware payload", "value": "6f37cefbb1e7ffb4b6e96483edd622f3be547d118ac653c240a87086c5214269", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785259814, "uuid": "8a168b54-6d55-4224-b29c-f49b6eb83e24", "comment": "Malware payload", "value": "f0996da5431709ac319774885ac3b94455207517", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785259814, "uuid": "abbb4254-8c81-4417-8ad9-3394f1b11570", "comment": "Malware payload", "value": "071e7061c6c33243f3d160b424e39995483b2008b0098861786aa1e8b869ca4035630f3781136e45dd25aa3517c9b8d4", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785259814, "uuid": "c6416fa5-1cc3-4606-8e96-c792a3c42e81", "value": "T1F4313A9E50101E399703DADF73A37588F20C84EB7897C79099880DFA86885C87152F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785259814, "uuid": "e3631569-2098-4d11-aef2-e0011b5f3564", "value": "12:URB6RHPN3R63j2G86UWa3p76qSDln36lnglGX6LQ2xDc6rORG6RyDnYL6nYa6a+C:Y4HPZmaSxIEzjtvg//vNvJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785259814, "uuid": "155ff142-7552-4474-bf18-dd2266a7f16b", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785259814, "uuid": "db279888-72ef-4bd0-91c5-860b8c40e318", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785259814, "uuid": "de4606b5-5268-45a4-9e01-405110bcfce0", "value": "6f37cefbb1e7ffb4b6e96483edd622f3be547d118ac653c240a87086c5214269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01eac0d-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785224437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224437, "uuid": "8378afdb-bcda-4927-8e01-20dc0d507f37", "comment": "Malware payload", "value": "3fc45f3c9d7d53578d97bcb5f650fb69", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224437, "uuid": "b18d19eb-1150-4b86-8bb5-baaae03676bd", "comment": "Malware payload", "value": "7045e83149680179a010cb19c85da630bbdd39543a142235d1b4913d8f6cde04", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224437, "uuid": "f1c70d68-b1b0-47d4-a3a9-01bbc9640b3e", "comment": "Malware payload", "value": "d724f88e5e514f4efde9127760f86d937fc539ba", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224437, "uuid": "eef126b6-76aa-458b-8c86-ad053600ccd5", "comment": "Malware payload", "value": "3552ec2b83c83387616e4c3e324db2940194a391405cc749fd8b68aff9761a266011eba9f528d399efb092c2021c0e1b", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224437, "uuid": "63d35738-41d5-4e6f-b53c-0f94e8d39ce5", "value": "T18D55339B764B14522300507A8A77E9F877C8E2F28FB216BD3F17F4142A3456B39F5A08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224437, "uuid": "5b33710c-c2cb-45cd-a475-6199a8948c5a", "value": "24576:2pBdoijInCpU46rKDtrM38hdgxwh86juiTWAytbeSspy1m314lSPYgS52:MhEnCpU46rKBrMs/gCiJPev4uq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224437, "uuid": "205d959c-a8e9-49dc-8204-5e45b73ffb85", "value": 1333420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224437, "uuid": "903f9c32-ed2a-41a1-8729-48599bc4931f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224437, "uuid": "905a5d6b-cfb3-4037-bb8a-85e1f807b0e3", "value": "rcuop_0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47be717-8a1a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785198326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198326, "uuid": "db4391ee-13fa-4bd8-ab17-556b6660f947", "comment": "Malware payload", "value": "05f261c2d8694cfe457c331abed1fa37", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198326, "uuid": "d22b32d1-b2c7-43ff-9097-58c4c0a137ee", "comment": "Malware payload", "value": "7070ccdf86771d89aa15bb3cc21e01b3eda0d5b81af6a87ef535940e8f7493a4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198326, "uuid": "71a863c5-0d70-4852-ad87-bce87b112928", "comment": "Malware payload", "value": "c609d6fa7b30ec54d9f9f05eb59bf9857ad98662", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198326, "uuid": "3d05097d-b7da-4b86-a7da-4dd1d76470e0", "comment": "Malware payload", "value": "747a877f6102a2a44035be35a0adc4c3fc75bbe1b5a56a48052770686a0f756ec418e042c914c32258e9c98b59365dc2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198326, "uuid": "28fc6a79-ab6d-4658-9042-b8bca5170a4b", "value": "T14801CECAD26459A040A9D42C22D75098F431C3CB294A8B74BF9CA43D9BA8E14F036FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198326, "uuid": "7046d2c5-3916-4cc8-b788-2891b9e29cb9", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkazCt855UkR7CeOClhDu+qC6OrRC5X:kXCKysE2hi0ziQvZohazXUWcauHpmWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785198326, "uuid": "99fe1b18-c9b4-4af9-8da8-ae77a830e8dd", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785198326, "uuid": "0af03b4f-4bc8-4e8f-9b88-e244d8d850e6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198326, "uuid": "26198b63-4612-475a-ad2b-060664ad68c0", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5df3db-8a1c-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785198933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198933, "uuid": "f54dbcf7-6bec-40de-81dd-5d857f710403", "comment": "Malware payload (RemcosRAT)", "value": "83aeb63fb1603957d07d2d92775daac2", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198933, "uuid": "792c3b34-b873-43ce-970d-b0d3a76fe29b", "comment": "Malware payload (RemcosRAT)", "value": "711b5be1f5c5d4c53d12c5e8415e401aa87e99de164178e2a602367922639ce3", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198933, "uuid": "b9a5180c-7d0e-4925-80fe-d19a4ff89184", "comment": "Malware payload (RemcosRAT)", "value": "0c8d49683747cbb9ac9efc702071395cae9fe2ab", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198933, "uuid": "e8c690a9-68fc-4782-94d6-64d4721dfc27", "comment": "Malware payload (RemcosRAT)", "value": "0d2c20a7d6ed6ecf1abe2d696eb3f4b0ad34e1a2a791f0a1c471971563b36d4d278f49e34fe286233ec8fbe208da2c33", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198933, "uuid": "bced08b3-78b6-42cf-996c-fc2099373b81", "value": "T1F9442720DCD80B3A0E5707EDFF514A65C9FDC529863690ECEA9E071E50125ACE7BF268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198933, "uuid": "c9cd35fd-28fd-4f83-b44e-3cd6db69e149", "value": "6144:Fup1v4hXho3BWCkLVNpXpwhIfLdhRlhCYfTE:iEo3BWx3paq56YQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785198933, "uuid": "db46cd17-1bd6-4f94-8cbd-c542c369603f", "value": 275664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785198933, "uuid": "ec7cf63a-46af-4d30-91f4-fc05757b1c1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198933, "uuid": "ba191da9-7095-4705-8208-60b662b53ab4", "value": "QU20262807.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eff41e1-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220946, "uuid": "41013695-9d0d-44ce-8b73-6ecc61645550", "comment": "Malware payload", "value": "1420772957a8c993ff7cde2f4f435dff", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220946, "uuid": "13145126-4959-4d2c-a774-1c1344654fc7", "comment": "Malware payload", "value": "71455de2becfa32d073fcd01215c2c5f3ed06b8e3f01eb1c096a159cf62fa52b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220946, "uuid": "b893f9ac-d9f8-4f39-94e1-1c149a2ff57e", "comment": "Malware payload", "value": "5e55ea1f9a25eeb03cd41ed8bc5b5f268ea60b85", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220946, "uuid": "2296fab9-e59b-4575-8cc0-6f3b9e4b3980", "comment": "Malware payload", "value": "867b8e1e6edc176ffa6c7ba381ec2c9e17a860895c3ec34b66e4540567202b09a4142c420631ca659a5703c2b2d14581", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220946, "uuid": "d73ac108-003a-4abb-8d73-9caed6cfc5ac", "value": "T10112C076450170A7C2FF941CAB8406708D1D28416F3473BAAAE1EFCDC8F6A158F43A1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220946, "uuid": "35b1c683-9c09-41d3-b3c2-ce46846a07a3", "value": "192:b9++2hhLTZBYf9a0aukx84hVNvxX4llsn154Lg3RtL4k0:b9++2ZBal4hVNJX6y4g3LLN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220946, "uuid": "441a4759-6122-42f7-8f9c-f473d13e8720", "value": 9739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220946, "uuid": "dc63cbd9-6d64-4cd0-ac79-e73ba43a1bef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220946, "uuid": "f2394426-ebfc-4f7b-b926-bc80ee097d09", "value": "images_20260727_211350.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e84e8d-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249833, "uuid": "a8ea8edf-d5aa-4b14-bbb5-8c8c7ea9285a", "comment": "Malware payload (Mirai)", "value": "b4006a53023f9c84f183291d49cb4eb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249833, "uuid": "7eda5080-a6c6-4a08-8da1-6627235460b9", "comment": "Malware payload (Mirai)", "value": "72b0288d2ca9b49417c62430c447d13b782f76553567dda143e1fe3e3fa0d657", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249833, "uuid": "03c15411-0fb8-4fc6-93df-42e1d24dc79c", "comment": "Malware payload (Mirai)", "value": "d54e413700d9c77592e8e68c670c4d5f77a2af72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249833, "uuid": "4c29b4f4-b93f-4c07-bd9d-03fae2fe9337", "comment": "Malware payload (Mirai)", "value": "1bd6288b0b601e7ce4b2f59fa25aa88eb9390611c51f40517ca7e81204b01fb6b7081d35d7d9faccde93f1ace2c39dbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249833, "uuid": "fa344884-2316-40c4-ab61-f090a4350f2e", "value": "T147F36A0BB8C054FDC486C2744BFEB136E932B46E5138B69B27806E323D4EE716E5C685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249833, "uuid": "ebce9618-6a0b-489a-97c4-cabfe782a250", "value": "3072:0lyvso7MWtECVAjX1SeQrQZyNVw3DG0IjqCUUhHZ1SA773U:ZhMWujRNGTAU/1zfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249833, "uuid": "ea0659d7-4b18-4439-a427-2f55415818c7", "value": 170392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249833, "uuid": "7806fe54-0524-439b-9e9b-5db1001ad53d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249833, "uuid": "965f3206-83da-4c54-b5fd-fc2188992712", "value": "zero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4e648a-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785224542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224542, "uuid": "b638e007-f4b9-4553-8d44-05737a6eb3b3", "comment": "Malware payload", "value": "84d62d70177d51f4f9e2f889023c2b94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224542, "uuid": "877b1130-afda-4535-9ad8-f78c8e376cbc", "comment": "Malware payload", "value": "72cdba5d584252b2320086e289c6118d8dabf1b5fc36fff9d0a647d3b6067211", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224542, "uuid": "a7f1ed94-9267-4608-83a1-34dba2b26232", "comment": "Malware payload", "value": "8c38c8bee7af20317805b1e0caf70a17bc7096f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224542, "uuid": "c1bfa4b2-23bb-4cca-ad4a-1d46e76dec07", "comment": "Malware payload", "value": "517393f73ed3d12917d925ec51421d88aab4c3dab792cc763ab20dacc52e90ff5295932d26e825841f2ad9967981ed51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224542, "uuid": "faddcd0d-fc85-4e44-afb2-88f1643e2635", "value": "T1723618136B68E74FC22822341DB2DAD467791C8506D79117B382F319E9F20AC9DAEDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224542, "uuid": "d235ea66-de4f-4516-9792-515b5c86cdf2", "value": "49152:2m+nK+DbIdmEejBnnlfC4n3E1OO/QcQUq4PriUYaDsXcQCrt5E8:m3vXcQAjE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224542, "uuid": "ada270e1-4a41-437a-b3aa-29f31ccb33a4", "value": 5308595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224542, "uuid": "4b51abb0-12ae-4772-9e21-7843c284827e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224542, "uuid": "99d65742-e384-435a-b248-f5ba05d39388", "value": "kswapd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32f187f-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785245917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245917, "uuid": "971df53d-dc82-4a35-a557-41594f4a278d", "comment": "Malware payload (PureLogsStealer)", "value": "22a57beeee5f4fe89de15d3d75c69ff6", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245917, "uuid": "12bfb9b5-880f-468d-b193-df6f7854f2ba", "comment": "Malware payload (PureLogsStealer)", "value": "745b84223b450fd185279bd8dab4f71ff149bb832ec147449313dfe7bca55e4c", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245917, "uuid": "a5397ad1-76c7-457e-b128-f5b8ebbb759c", "comment": "Malware payload (PureLogsStealer)", "value": "6f74310d2a30f63980feaa34e6748e2e134fc5db", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245917, "uuid": "1dc4ddf1-284d-42d0-ba8b-065ff399acfe", "comment": "Malware payload (PureLogsStealer)", "value": "44a24bf8b6e7c958ea807d4fa420e69d4b37a0dd1203d8471bb3d6be0a10f76a7077ff1053b640a4ddcd1427ced8105a", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245917, "uuid": "53f692a9-50b3-4741-9817-62d82d3bb621", "value": "T108968C1AFBA801E5D077D138C5928636F6B27896473197CB12A9D72A2F33BD05E3B311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245917, "uuid": "b61839c3-bda9-49d9-a577-2035ae446dc4", "value": "98304:u6zCF3JnVFVVhxjjkh2PBap/8lu5dZDs:lzOVbTTPBk8CdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245917, "uuid": "07ac7801-745a-4462-b145-2a1e5369b15c", "value": 8624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245917, "uuid": "aa9a899f-5bf7-46dc-a7a5-2c3d9d73386c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245917, "uuid": "fa429843-9975-46db-bc9f-eafc333df30f", "value": "745b84223b450fd185279bd8dab4f71ff149bb832ec147449313dfe7bca55e4c.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46339b42-8a96-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785251345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251345, "uuid": "093d7189-5659-4f7a-a1dc-2370aff4734e", "comment": "Malware payload (Mirai)", "value": "c37dc6bbcfc47837a364aaba1a7365f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251345, "uuid": "a0e8a07f-1cba-4075-8d15-8d53239df00d", "comment": "Malware payload (Mirai)", "value": "74844fbc4661bece25f4d2a59f77fba423e7a5756f39b57b8a5e0a83ac68f267", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251345, "uuid": "d2114801-e953-4ccc-b5bc-06bd1540e783", "comment": "Malware payload (Mirai)", "value": "5baffbbb0d2253be5b7d563cc88d16b9e8d4f1b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251345, "uuid": "d4d594ec-b2f0-420f-876e-cead2054c34c", "comment": "Malware payload (Mirai)", "value": "d7a905cd4bcae0441d24ae79320199a639d921d3b5cffb063580e5767ab92882326cc2a6316d9e78299a9f3e04b8d918", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251345, "uuid": "873a79a7-41d1-4bed-b3a4-44861d2ab295", "value": "T1E0F31856E8819F11D5C156BAFF0E528E33231B78E2DE72129D246B747B8A87F0E3B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251345, "uuid": "51491810-eae8-43d2-b739-17dfd15b636f", "value": "3072:X6n12ktHHWrKIMiUi5+RRtDoojuAakAQi0sXF8aLJXxTPdzDOxHy:X6n12ktHHGhMiZSRt8ojDajQbW8aLJJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785251345, "uuid": "5740d309-bf99-45a3-9689-64c0d732f93a", "value": 170836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785251345, "uuid": "4995cf84-f694-45d5-9315-df0dfdd700c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251345, "uuid": "edfafd81-cf8c-4c02-b7c1-6c596ddf6d86", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea94cf3c-8a22-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785201799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201799, "uuid": "7a94311f-e77f-478f-9267-38e9029eb9ef", "comment": "Malware payload (Mirai)", "value": "8ce413a2270f4440473fbdb82d9d3d3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201799, "uuid": "a1c1a493-2582-479d-9e7a-edbe7f06db31", "comment": "Malware payload (Mirai)", "value": "753936cf1764b98686e87cd140ba7c0234973e1b5339b096f86edc34906a1a77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201799, "uuid": "b336e7bc-2073-4628-a880-dc7108040fc4", "comment": "Malware payload (Mirai)", "value": "d120f7eba74d6f39eea80e9193be341c48fd2b39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201799, "uuid": "5bd0e49e-78df-4825-9912-cf1157723cd1", "comment": "Malware payload (Mirai)", "value": "fb5ca1f7453546b7292f90928c398c6def03b23f9ae38923699cd1775ebeb687fda73677ce64cc2c4a84041e209ab6db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201799, "uuid": "bee83aaa-3860-4a17-bdc7-9201ed809d26", "value": "T105A390A85E4F6E82C2C2E37EAD890FA231373DB4C360C2B25901A6DED9D9DD5DC55423", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201799, "uuid": "fe4427d1-e1c6-4f58-8ca7-bb3da25826d3", "value": "1536:4Lx+ng+bAFil/Ws4MeEO5vPZsvFAXaapD8PCkE7KOC54L6nS9c45Ir:4LxHPFiWsABS2aODPkE7KhRnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785201799, "uuid": "d967ab49-fbdc-44a9-9ab1-6b62a3a1f59d", "value": 99768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785201799, "uuid": "a0cc5b72-a8a2-40c8-b44b-78fd697afced", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201799, "uuid": "3df50a3d-4de6-4ecf-ac6a-d83a89b3428a", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f441331a-8ac1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785270105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270105, "uuid": "57b992cf-3b5d-4ebb-ac7c-b4d5d99a3740", "comment": "Malware payload", "value": "2e4077197293253a06bdd46ce433b505", "object_relation": "md5", "Tag": [ { "name": "103-193-173-83", "colour": "#A458EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270105, "uuid": "3418e229-1980-478d-abf1-efdfb1e62dfd", "comment": "Malware payload", "value": "7539c48603f670a8a14c59391c1bbc01371635b89ea06f2f68cf273ac709f8bb", "object_relation": "sha256", "Tag": [ { "name": "103-193-173-83", "colour": "#A458EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270105, "uuid": "d2f3beaf-52a7-4118-83d3-2f81277a54db", "comment": "Malware payload", "value": "c57ef42c52efa15f8f9ec2cf14e1d6d94d925c9e", "object_relation": "sha1", "Tag": [ { "name": "103-193-173-83", "colour": "#A458EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270105, "uuid": "694f99ff-873f-4b55-b79d-55471567f96a", "comment": "Malware payload", "value": "150bc03650d99d6b7f14476d512431ea90630e2750abb55fdc425c8900c6da39bf1b549f39648ae68a4f7e823b79ff6b", "object_relation": "sha3-384", "Tag": [ { "name": "103-193-173-83", "colour": "#A458EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270105, "uuid": "18a7e5e4-7e37-4246-8d76-9e3c19fc3f1b", "value": "T14AA58D56E2B360ECC66BC171875BEA67F674742C41207E7B9990C7302E72F50271AF2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270105, "uuid": "7b2953ed-964c-4c15-858c-f1021c62771d", "value": "49b533d8c0ce90df0101f35a2c0af7d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270105, "uuid": "004b0a0f-b5f9-4616-bf84-1b2648ee8d7f", "value": "49152:EBkjNIR9hbVDy/mqtP3G3c/3eWJrePHfR:qhb+osv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785270105, "uuid": "3282c96f-ed90-48b6-af45-445960caddd0", "value": 2131968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785270105, "uuid": "1bfc97f4-26e5-4d8b-b5e4-f0f4b6ed6011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270105, "uuid": "da954bb2-b836-4009-ba9b-169793d032f0", "value": "payload(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec04f23-8a21-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785201242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201242, "uuid": "02c93b19-e83c-4c9a-ab0e-8070ede626cc", "comment": "Malware payload (Phorpiex)", "value": "da3c4fd3f4f3738f9f626c96de56a535", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201242, "uuid": "0db8e5ff-1c36-4051-a90a-e7c487bde3cb", "comment": "Malware payload (Phorpiex)", "value": "764d5bcb4be851ed27008a40010ed48669160dee3c83fecfc3a0c0654dcece3f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201242, "uuid": "f2fc043a-9210-4a1e-b6b8-f020387783a4", "comment": "Malware payload (Phorpiex)", "value": "5782b6c0bf1eb4022d8e5c9d80968add1a761e08", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201242, "uuid": "b0764b58-317d-4e77-bcde-733c99ffcfab", "comment": "Malware payload (Phorpiex)", "value": "0de3f26e31d0279ade4d2f4ff11794f1439e77607998306fdb0a3f7a92d9952d28120cc76b50db991355668c291921f3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201242, "uuid": "52a63722-bce5-4f42-8227-c2f765548597", "value": "T1DE623A0AB4818035EAE04075827F526649BEADB623C4F9D7F7E0A8C94DB4BD1F43516F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201242, "uuid": "3c3234fd-d44b-470c-aa1f-b68565babe48", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201242, "uuid": "0360fd7c-2a66-4fb2-bd26-8a12bcf9be63", "value": "192:AWCsGnjXgjk8LcRI+Q1RDMRYfV/F5oIVUBKUSftzQFBrfgJxTmv8U9cthv9ik:AfScCRfV/ro6toB0av8U9c1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785201242, "uuid": "09b297fb-d3b3-4388-a0ae-0846b4744922", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785201242, "uuid": "8c268309-061e-447a-89bc-42ea4e7b5c64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201242, "uuid": "af5ff9a8-24e7-4692-9dff-4dc7bdc77675", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9326271a-8a8b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785246749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246749, "uuid": "b80be8ae-5c62-4fc6-b33a-9c9f0520f4f5", "comment": "Malware payload", "value": "91cf8c20e92179b68080415b5b06ffdb", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246749, "uuid": "623c1b80-108c-41f0-9303-c1c325da29c8", "comment": "Malware payload", "value": "770498da2cccf31d420c0e8056b3eb890891a4c58d205822654183fd5f61810d", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246749, "uuid": "26d8ae53-28be-468b-9ac6-86ba9ee8ad50", "comment": "Malware payload", "value": "2ac9b11e299976279913454cf9f4b81f9422a0e4", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246749, "uuid": "48d0eccc-f754-4aa4-b36a-36ea0015ba4d", "comment": "Malware payload", "value": "7a5e212023a947f0e9bf196736036839f82653425c42521146eb6e9768ac034c7e7628b5b205127880489db05669b67d", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246749, "uuid": "e791cd91-2430-4b66-bcca-08b737514d09", "value": "T1F004D57074F715BB025BD4B62B9BAA0E6EA0820BC10BC94C7DAC53C44FC5D558CE7BA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246749, "uuid": "491dd18c-8b99-45e4-a3a6-1d02bae9146a", "value": "768:ZyBbWNF0d2f8kjbyaPH6JnIH7AJLj1PwNaHx1pLQXC48LIGj7l6vLxDGbh9xFH/i:wGJmlwNq1p8SDkGjx6vL8tF1EBYsnb2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785246749, "uuid": "202086a8-afaf-4614-a7f2-593e01f8e0fd", "value": 183759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785246749, "uuid": "48c09b08-1f8d-48e2-b962-ac00344c4a1a", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246749, "uuid": "9c0bf3d1-46bf-440b-a100-68ca3bc3cfb1", "value": "UubUZoRSEo.phtml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9887241-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785245928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245928, "uuid": "05ef0264-4b93-4d7b-bc6b-e8de28dade0d", "comment": "Malware payload (PureLogsStealer)", "value": "cb61129250a920671780c27209531b71", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245928, "uuid": "cae7bff7-64fa-4bf0-9adc-736078fe8c36", "comment": "Malware payload (PureLogsStealer)", "value": "7730d2322f1057df4a3c724e4a4f64e7a6c6a06783f63a0eaf99f7dd4ab16ce4", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245928, "uuid": "add639d7-7129-4483-b3da-40eab367fb94", "comment": "Malware payload (PureLogsStealer)", "value": "9b077b32b5c9dc0378ee8e56fd9a8e45f2f62c6b", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245928, "uuid": "fccbe247-c1fe-49c2-b0e6-333616f45a61", "comment": "Malware payload (PureLogsStealer)", "value": "604e97fd6a9438fde4af4793cbdd034143d466e3cbaf06a587bc2b8103dfa81d0b23b13b827bc7ab455402e3eaefdfcc", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245928, "uuid": "e0efc87d-c8a1-4779-9dd5-3222c123cd5d", "value": "T15C16B092B3C46AD9C456DD399714F232C1B2BD234B7AD0CA699AC70A0F7AD514F3EB40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245928, "uuid": "6bed4fa3-9ee6-4eda-9ac9-6550d5269557", "value": "98304:5e3QEuLVsR1GRPNgTOzai3VY4ekajO+LZihVWdFVRchY7adH1qe9NTyzDSHf3sDF:sgEuLVsvGdim3lXe1S9VWdFVRch4GH1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245928, "uuid": "6bd6852c-d7db-4388-8487-d6af2171f446", "value": 4247552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245928, "uuid": "02bdf4e7-dd4c-4dbd-a216-5e109924e81f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245928, "uuid": "dc6d77fa-64c5-42c9-b9fa-bf93b81b1bd2", "value": "7730d2322f1057df4a3c724e4a4f64e7a6c6a06783f63a0eaf99f7dd4ab16ce4.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f5b6d1-8ac4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785271375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271375, "uuid": "17b3da37-1088-48f7-9012-4a83389c0928", "comment": "Malware payload (Mirai)", "value": "ede604f1401d7e455a118127ea175266", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271375, "uuid": "f50480fa-2b75-4fac-b177-cc6a185d23dd", "comment": "Malware payload (Mirai)", "value": "77755cc0490521af6f766826172706f091c6963af70e5e23cecd9567a72cd336", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271375, "uuid": "3b87d870-df1b-4d35-b88e-394778700004", "comment": "Malware payload (Mirai)", "value": "b84a50caa282ace91b3a567d8d0386fb67576e95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785271375, "uuid": "aaee3de0-75e2-4332-81e2-5f2b598f0aad", "comment": "Malware payload (Mirai)", "value": "cabb1e5826ec3aa49e33590247c736fb351c71e009fef53c05ffb6142248e04d105805292b30e6b2267583fd4842f4ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271375, "uuid": "7538f1fa-54e6-4fa3-9b22-bd7044721e2a", "value": "T10DA3E94AAF651DB7D81BCD3705AD0B4235CCAA0771683B763934C928F64A54F8AE3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271375, "uuid": "83c1b4ed-d8fe-4b0b-ba13-a6d9f3deb31c", "value": "1536:FyerkQ52P0oXGBiNlwVf4SF8836992xPfTuJ5+U4pyU0tcmY5y/b:UIwP0oXciNl2889/yR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785271375, "uuid": "acbaac13-b8ae-478e-a2c8-93fea4698b53", "value": 98316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785271375, "uuid": "f86aae73-7e51-4c72-802d-a0f515a8d3b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785271375, "uuid": "7644720e-ae4a-4f50-87b3-b612bea1d50f", "value": "LrHq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f4c1c8-8a7b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785239959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239959, "uuid": "91d79360-ff6b-4686-a2ff-affed91c318e", "comment": "Malware payload", "value": "ee235e5465aeb411bd42ff405fbe86e9", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware-analysis", "colour": "#279256", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239959, "uuid": "aba5dc11-bcda-4d10-8a16-618cc6334273", "comment": "Malware payload", "value": "778d80c1ef9f0fa2bc2165b5db6c22734896e88be493c3ed2381726e009fec14", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware-analysis", "colour": "#279256", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239959, "uuid": "5b7bb129-d5c0-407f-a554-c679043cba86", "comment": "Malware payload", "value": "7044714260e2d9b187b7005ae5f11d158ce8f7c7", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware-analysis", "colour": "#279256", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239959, "uuid": "ca8487f2-304b-4108-a9e1-c8f431311a74", "comment": "Malware payload", "value": "d40154eab4bdbe66131fb14a22653d10ed85822e45f736608397f83e43a9da6c0fcb0001003281fdda505cc322ad7e8b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware-analysis", "colour": "#279256", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239959, "uuid": "6eba12ba-1569-4ba6-a668-92b99c25dd8e", "value": "T119E52392A300153FCABB5D359AEA87B157398E24CA95370B9980362C5D733DF4F99EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239959, "uuid": "21891e4c-b1be-4240-88d7-83ee4e9bc2ba", "value": "49152:K2xpQFMUQl9GbY+XMH6IQKUS5VYjOw16B0FKCwfvnbtxk6/mFYXMnIAZlriUEdPV:Hp4EGbOH6IQKtH9DCKpnrk/FYGIqri5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785239959, "uuid": "16f8fa8d-7b75-424b-84dd-6b0968e253d3", "value": 3109577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785239959, "uuid": "48e43e1e-4dd6-4859-bc07-83336528d6ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239959, "uuid": "699532b9-1c5c-4e5a-ae02-93d7c1122361", "value": "app (46).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f327e1de-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221141, "uuid": "180246cc-a54a-4bf5-9466-148b25b71a9b", "comment": "Malware payload", "value": "9a006edf8bbb0eac0493badd7d065e33", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221141, "uuid": "1bd92118-b3bb-4e37-9de5-413b9b85e204", "comment": "Malware payload", "value": "77d5b00de0082d4ba6b33a58a5153ac4036e4707b93c23a47c91e4e82cafed46", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221141, "uuid": "09f7bee3-225d-4a53-b4ba-25a44c1cff2f", "comment": "Malware payload", "value": "fa9703ab4304e47d7998e1ed7ab8b066d5d83238", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221141, "uuid": "6b4e1acc-0ba1-4a5d-9f9a-96e17f0b64e4", "comment": "Malware payload", "value": "fd2ac809b9c0efe3e528e1493468bb1630d0d1b4a1c9b57e7e9672b767166d0e920b432a9aa6bd453a91dcc85d4bc1e6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221141, "uuid": "bc14b6d4-3c0b-44ff-95ab-5bf388524342", "value": "T1D762D15D5D8CCE09D28D451FA29BE0644C7060817DD2F8E30B28C3CF660C9E95273536", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221141, "uuid": "b56d24b2-9aa1-438f-b6ef-a6aa569cf2b2", "value": "384:mB3ktd+jtShFd/lDH36UYyBfafKEc3p7rl6h0eVnM:M0tCShFTDbYu73pHweeVnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221141, "uuid": "20591c47-3f22-4c7a-9593-553a535c9664", "value": 15389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221141, "uuid": "9f0d51c5-3674-45e4-b40d-f1e48c5ce3ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221141, "uuid": "af74f440-e7ba-4931-a31a-c391b542e2c5", "value": "images_20260727_074551.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c651825-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220941, "uuid": "8b4753e0-f3a1-47cf-b96c-94f4f0d76f7a", "comment": "Malware payload", "value": "2be804bebd535f090cc82e3f0ca3f0fc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220941, "uuid": "695030ad-c88e-45ba-a3ae-b493e63b8a6f", "comment": "Malware payload", "value": "78df7e7fbcea7a4c9c8515a0202c96b3cccad3fee942ac55261a56a7862687b5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220941, "uuid": "4334734a-e761-4b54-b7b6-710a06be5d25", "comment": "Malware payload", "value": "b69fcf426a15ab926a14253cf56cb051af880aa2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220941, "uuid": "56ed06c4-ec5d-454a-98b7-131bbc61947a", "comment": "Malware payload", "value": "188a20c396ebe0cabbfb5a1357c6af727094fa74e921e4b28be420007188e4e6237c04f0a8700c2dfed2c35ae6af3f52", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220941, "uuid": "58f671fc-f6aa-48cd-83aa-e7aac3b67bb1", "value": "T10132BFE10746500FC126F37E3DF04C8C9448614B3A3EB9C65615BC6B668AF779326DAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220941, "uuid": "72873e98-6fe1-4017-812f-e5a5c3095dbd", "value": "192:1/Svt3KT2xEI8ysT8jCevdxyR163izWwGPsRWLKvTAqTAazr/DT6xn72:1/So6mVT8jCGdxcKxVPlKUazrr+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220941, "uuid": "ca622aa0-886e-40f2-ac3a-6f8f50b12d18", "value": 11200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220941, "uuid": "bd2f61e6-50cf-4232-9499-a8bc4437b0b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220941, "uuid": "8b2b78a7-0e0f-484c-b7e0-fe1e6bd294e4", "value": "images_20260727_175446.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ce591f-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785211154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211154, "uuid": "3d69bb88-2666-4802-93fb-f8cedf30db70", "comment": "Malware payload", "value": "9ad091c28edfad14e6ff2c99c2c57cfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211154, "uuid": "5c8ead0f-378f-4e16-8875-c4fd7c2dccd8", "comment": "Malware payload", "value": "790ddb9e140c87e3bfaaa810f8ec67e09bb028ffdfd17d13312a8c3b735c9435", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211154, "uuid": "388c0d40-b4ff-4405-acad-ef0e43be1959", "comment": "Malware payload", "value": "6746755015aa075bdd6e969b1ede8e256784eb9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211154, "uuid": "0b0cf99b-5dae-4c26-960b-87bf699bc2b5", "comment": "Malware payload", "value": "c44482249b356c1845db24bae489f4326f1e4a287b5d555f06148b228051cd6f83711ed94e83a39526c4c494b70a2ec8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211154, "uuid": "ab139919-8a61-4acb-8dea-2ad2731f6b43", "value": "T1BC31AA57EBD06EE7CC0C9A3580AF07223393C4F516D1971B5A14D2662C8F2916E32ED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211154, "uuid": "c991c764-85e6-4808-b42f-dcc46e47fa91", "value": "24:wO2xVu7OV+nO2i9AfEnmKgYnHbyx+mW7Jl+:wxVqgCO2ioEJdZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211154, "uuid": "28672919-befd-478b-962d-6d36cec1f9e6", "value": 1672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211154, "uuid": "092afbbe-c08f-4b57-b8cd-3fcad258c61d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211154, "uuid": "8bcec4dc-36dc-48c7-8de1-d6b6e38e3733", "value": "rawbot_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d3a188-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249708, "uuid": "21c45098-083d-4f49-b0b2-f5da5ca92571", "comment": "Malware payload (Mirai)", "value": "1bdd6f1f223b3ed6224e3043672efe14", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249708, "uuid": "9ac57909-797b-45e9-8144-b48df58c58dc", "comment": "Malware payload (Mirai)", "value": "793e8ef1cc06155215a32d1f847ab907cfb7f1e870495f4db111d7b0a243ffe7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249708, "uuid": "f4687aa3-9b2d-49ab-bef6-ef0dbb0c1640", "comment": "Malware payload (Mirai)", "value": "5ee3b52a004dde80ee68153e8c5b071145359f7b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249708, "uuid": "1e52ea79-0bd0-4afc-aefe-be3189045992", "comment": "Malware payload (Mirai)", "value": "7516ffcc61c0c285712451cce8b12cfed1698cbb906fd95fbe8c9e79b360e7bd2b11d71fa7204d93d5ec94f78d04d4cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249708, "uuid": "07e917d6-80fe-4c3f-8ec7-b1176149e8f9", "value": "T1F4430263CF616EB081F2C835F950A61B3C6BE1B9A1D738760806CA094F49953729BD8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249708, "uuid": "d0cfb89b-33ac-4d4c-9745-151c5ae96e4c", "value": "1536:c4LTz4QdVrDrGTEIv0d27IA2LACNPiYu4PmnLm:ca/4QdVOcYj2Zy4PMLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249708, "uuid": "a5cdc5df-0bf2-4714-b604-d837c1a4a16b", "value": 58840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249708, "uuid": "78e16606-f3a7-4624-befe-4f1a5bf5e9af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249708, "uuid": "63557ce8-26e2-483f-994c-0e84a9e93ed8", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f997fe-8a8f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785248385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785248385, "uuid": "68cd4db5-1eaf-4ec0-8f4a-00a303bfe042", "comment": "Malware payload (Mirai)", "value": "36d06c0a520050450a40762b3ce62c86", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785248385, "uuid": "743ebbd0-e42c-4c8b-b2d6-f2be529aafda", "comment": "Malware payload (Mirai)", "value": "7a10aedb49a9c772881350b9f78d43bf8dc805a9d7555ea709cf13d101f9a10d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785248385, "uuid": "a7ad886a-a6a2-4e9f-becf-10fe8a1dd5a4", "comment": "Malware payload (Mirai)", "value": "d7ddc3d24bf72f310d7276e7cf68dd5a347d9250", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785248385, "uuid": "a91306ed-cfcc-4d82-85dd-f6cd65ed0082", "comment": "Malware payload (Mirai)", "value": "a4e82b5d94a4b8d83eedf9f3fa90eb5277810334b8bd2b2ba675803d496fc29cb3113fc9a10aac5f66e6b05520a2c402", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785248385, "uuid": "32cd582e-c507-4afc-952d-f170e6b62c69", "value": "T179E0DFDB0011630846889D00785A0A392A6F82A030379B1C2242A4F6CAC911DA83AFCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785248385, "uuid": "e548a9ce-51b9-4bb3-b254-3dfb65e67140", "value": "6:KbA3JP8khELVB+nA3DQ8ksWQELLcB+nA3cxh9yLcMB+nA3Ij7BxhbQxIMBnUv:KbAZPfhE3+nAzQ8ksxgw+nAyhgLcA+nF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785248385, "uuid": "e1a6e8e7-4fd8-4b69-8773-0bdca3171fbf", "value": 315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785248385, "uuid": "8cea1e81-dbbb-40cc-ab7e-ac1e346289d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785248385, "uuid": "720d624e-ed7a-4948-ad4a-a62344019160", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de0713a-8a96-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785251438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251438, "uuid": "1f1fdb1c-57ff-4204-9c11-9e766d036524", "comment": "Malware payload (Mirai)", "value": "fe526caf2ae90ed63f822f88446f0dfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251438, "uuid": "ebdae535-9563-4af4-9061-874fd7320861", "comment": "Malware payload (Mirai)", "value": "7aaf8b24397530ac4de370a961d0ebfa5b9e03a1fc80510eebf5e0a2588a40c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251438, "uuid": "8c900bb2-ae08-4e0c-ac3d-ac85bc733813", "comment": "Malware payload (Mirai)", "value": "a979851eb3c9af9cffb39b45bb2627414e7f399d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251438, "uuid": "d4adaad9-0551-403f-aa69-d28cfe8d46da", "comment": "Malware payload (Mirai)", "value": "a5175b869ee0b45e35ef79851f835b8870f80de4ca68f11c42d77897f342d5c97524d8a8a92084dbc3a34aaad4dab4b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251438, "uuid": "6d17b5bd-a971-4294-aa63-29f652e1c396", "value": "T10E24A40AAF510FFBD8AFDE3746E90B0625CC654722A83B3A3674D524F50A54F4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251438, "uuid": "c6d8352a-c06f-482a-b55b-903666ae34bb", "value": "3072:1uFx54bI144Xdq4TS+EP+mZA1P9fJ5Es6zgjfx:1uFxZ145d+mZI9fjb6zif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785251438, "uuid": "45b868f5-09e0-4cb1-8540-99b9440655cb", "value": 210748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785251438, "uuid": "54c68e94-c27c-4339-8d20-1d41f67e03fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251438, "uuid": "35b9aa75-b815-4f43-89c8-656d29f60863", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d846e75-8a8d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785247545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785247545, "uuid": "ce23d697-c3a8-4223-b003-6375c9b3217b", "comment": "Malware payload", "value": "f9bb899300fea378e92bb8d2c13a5e8d", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785247545, "uuid": "67056a80-cb1a-403c-b047-595fa9c0c4dc", "comment": "Malware payload", "value": "7ae5731b5fd3bd9f27d4d31e9513f893eceaf78a44afec7beaaaa37fd7cbdba9", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785247545, "uuid": "81af3760-14d8-4f25-a9ed-07cbdbefeba4", "comment": "Malware payload", "value": "26e45e5617d3afedaaed8af63601ff9f10d67bc6", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785247545, "uuid": "55012e64-1597-4dec-bf83-957248dc620c", "comment": "Malware payload", "value": "b23bcc6fb3d29f2cb2dfd1a1ff559d19013bdecc3b7b7fa4dc1f6d06833552519f25e355cf6d45e81a2b2a147475e1cb", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785247545, "uuid": "08df1cf3-5e6e-4cd9-b0b6-0fe5bf5bbc76", "value": "T13932D78A66885E399033EB394783600DF595427B55084A407C9D27DBBFF2B0486F6FFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785247545, "uuid": "001c08e6-11ce-48fc-9c25-8a942cf6805c", "value": "96:IfcsfcWJgtirv9NZuH8wYkiMRcWN/ZMFUnK7/9+MeMRgmF48WTv57HmDH9OzLI0r:lh+gwk85MiWN0EoFF4lTv5bU87rKdn/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785247545, "uuid": "fc2175e3-bbce-4fef-9879-9517db304775", "value": 10944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785247545, "uuid": "1703e6fd-57ce-44b2-b39f-299b11b73096", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785247545, "uuid": "abc8b895-ebc7-436d-a35c-fa544e2ab341", "value": "index.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c0a64c-8a91-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785249363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249363, "uuid": "e018138d-c2c4-4671-8ef2-57840d28de2c", "comment": "Malware payload (XWorm)", "value": "b3ae810b687b2038bb6cee9fe9a56e89", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249363, "uuid": "8883d242-832c-4a02-9a8c-bda782890623", "comment": "Malware payload (XWorm)", "value": "7b1ae703f7b4a9e755aafbb4198d6f0b917b885dcfc0a3c720b7f4211541b2a0", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249363, "uuid": "21512748-8a48-49a3-9a9b-6372d34574c0", "comment": "Malware payload (XWorm)", "value": "ba1d5dbb719eb6b1b3e9ee41d6621dd491e33b93", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249363, "uuid": "309d5168-67d3-4530-94b7-120bb73e78b0", "comment": "Malware payload (XWorm)", "value": "aa672f92109631e1b5ec77b24d7dfdafc5878e35ab5a615c699fded6adb7eb1035cbb1bcfc7eb7a11f3b61c3f25141c0", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249363, "uuid": "134b044a-5fd7-430d-8b49-b01f11f8f1a5", "value": "T1525109D7BA70E581E9EEE77103F9C6F5749104CC2A254A783B14A9B5304E014E306BBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249363, "uuid": "648a5ccc-d2b1-4476-a2d5-bced496274f9", "value": "48:u1QLIUFgpk3aUP0aL2fuwDQvNsZu/yfrfvOiUOIwAq5Oz6ZaiYSu7T8:w8FgUP/RMwyTfvOiBIwt5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249363, "uuid": "05bf5081-a0b4-446a-b507-301b44fdea6b", "value": 2847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249363, "uuid": "53e5ec35-330d-472a-bfc5-6628e1a2a19a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249363, "uuid": "a697ef62-69c1-4e42-9416-638eaac1a31c", "value": "Slip-02.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a5ff5e-8aa7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785258590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785258590, "uuid": "ea8e0623-af97-424e-af30-864d66860353", "comment": "Malware payload (AgentTesla)", "value": "65cf20e853f49dc94f6eb5f8a194391e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785258590, "uuid": "9bb4e446-34e7-4c20-902d-d47c3adeac62", "comment": "Malware payload (AgentTesla)", "value": "7b6e7aff859d03e87c3acd4f8caf8e540faf49756f4af5bbcd4d15683bd9c504", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785258590, "uuid": "7297effc-3731-4f10-9fd3-c963497f8e20", "comment": "Malware payload (AgentTesla)", "value": "96a3cef0322d4f6a63252ff074fcfd524a4cd3ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785258590, "uuid": "96f1bb16-a2fa-44b2-aa58-d74e6be0f147", "comment": "Malware payload (AgentTesla)", "value": "585a46a2fb51a1932960687dfa96265df071d723eaac90743ec7cf662cddd161aff895f8d63bc492bd28cecdcd748f54", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785258590, "uuid": "d1fbf2bd-d27a-45ec-86aa-3af9867cca9c", "value": "T183930C1649D778D0633776BFA22AA8E4F7760B6702401917B83C6450EFF2A0ACDD1DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785258590, "uuid": "65ec8ad5-d411-454b-9a20-ef752cf226cb", "value": "768:KCLhdJzIo5gbH8PW0E4xW0vEMi+XfHnKoGL5ep36CTiDg1EpqX+Qw2/ZVdzz+dVS:bZ1vE47FrN738wdSjgrV/qmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785258590, "uuid": "17fbbc79-a9b7-4661-92b1-abae0eba4536", "value": 89966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785258590, "uuid": "5d403c74-cd29-45ca-8c85-04d0614b5551", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785258590, "uuid": "9b7c6ec9-b29c-4a84-b38f-9278fd6a8d20", "value": "Nomina 07.28.2026.pdf.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc3f397-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221162, "uuid": "751f4274-f295-4da6-9981-eae7f1f8e021", "comment": "Malware payload", "value": "a83732ace0f05925e2f6218af8fd05a7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221162, "uuid": "2d39285b-6815-466f-ae19-0575f59f8fca", "comment": "Malware payload", "value": "7b7630c690bc8d6bb526f62cd49a546acd4067f9766874d6fddc9b95c079d9e0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221162, "uuid": "afe36a7c-3a24-4f2a-98e0-ed2b8c1ab69a", "comment": "Malware payload", "value": "0ecf00cdf31468a1183e805ea91a0047f0806922", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221162, "uuid": "aed719ee-5a17-4c83-b6f8-057a7e6f6401", "comment": "Malware payload", "value": "7a1226f816fe72c322a831ada56fd3042dd061426aed54c81fbd8788f301f1dbcccd0536c226f4b3c72ce78a5b0b71f0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221162, "uuid": "05ed160d-eb6d-49b2-a5a2-3d18235f932e", "value": "T1DC22B08A7C66A41F9F8151318AEC665C126A3B20BF183D17F3E44E9D74C59A6923C083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221162, "uuid": "19f96ac9-22be-4d0d-8c5d-ee154b0d530d", "value": "192:JTP7oLIIixnC2inCX/MqCPyUFRgzKwCuNElB3axzzOHFt06:x79IidOy1CRAFCuwMsXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221162, "uuid": "29539431-f566-40d5-8fa4-6ee422668709", "value": 10412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221162, "uuid": "a793f747-d015-4f06-99ba-431fc5fec01e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221162, "uuid": "dc108b71-3333-4a17-9d90-440f920a8b23", "value": "images_20260727_065640.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b946fafb-8a99-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785252826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252826, "uuid": "aae9552d-7033-4cae-b25a-0e288c118969", "comment": "Malware payload", "value": "7c4594c4cc3ec442ff245e654af0e8b7", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252826, "uuid": "5254cf6b-fe77-45a3-b69a-1eaedb3faadb", "comment": "Malware payload", "value": "7b7ce9d180d5c015b8a16302342deaadb31895dae7cb8c1ced2c101111ba5c06", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252826, "uuid": "b76c5dc2-e9fb-44a3-881a-05e985898cdc", "comment": "Malware payload", "value": "26ad77cbd4032dce1d3708fd6a75cea887366558", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252826, "uuid": "ebc0b9f2-370f-472b-997b-056f3871b725", "comment": "Malware payload", "value": "267e17666d0688e9684a1982ea89a79f52feb8b43fd12094b9bbe8f4acd0a1ed353976898be6290f23b75c2dfc625425", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252826, "uuid": "8dde6efc-effb-4049-9d2d-6c4c3cb23adc", "value": "T1D3B199E88A00C143976E5D585FD126DFA1B01B97B00E1ACC5AB1BF4BA6ECD84F09C9DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252826, "uuid": "90be8616-7020-47da-bfc2-3f5f1758a1c8", "value": "96:Bu+HXav5g2GcqMmLkwCUpnE8I149nIQuK:BZ4g2Mb31E8K49uK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785252826, "uuid": "2de294f4-c767-41cd-b9ef-83ccb390849a", "value": 5428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785252826, "uuid": "e98f3d5e-982d-45cb-8052-75c2b6357829", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252826, "uuid": "1e5a7f92-3ad3-4af6-be7a-261bb4b9fe87", "value": "nNzhR.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0827a0-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785245937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245937, "uuid": "672ab005-a6f1-4beb-aa21-498bfbdabc1f", "comment": "Malware payload (PureLogsStealer)", "value": "4625e74a2153f3b6def764bc711ac31e", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245937, "uuid": "47a9e6a7-c80a-4013-83bf-8d3cd5e5116e", "comment": "Malware payload (PureLogsStealer)", "value": "7cfc514481d2c36325b8a29f088dc365f0adc7b813b329722054c933a9a1aaf3", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245937, "uuid": "a87c248e-b211-4072-935e-b07d718faca9", "comment": "Malware payload (PureLogsStealer)", "value": "e70344516560b1e8013fb8a60b565ed3b1e33925", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245937, "uuid": "303f1c50-7db1-443c-bbae-caccdb1c63ec", "comment": "Malware payload (PureLogsStealer)", "value": "5cbf6ed10e3f61edd38dfe00c7fb4be53f63c3ee390240d9708e7a8022ffb9d7dda0e8dd3f87d9d55709fc91f34e60ef", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245937, "uuid": "26afc1c7-0955-430a-9866-145155b58a95", "value": "T12DF5DF14A3E801A4D977E638CA959333D6B078969330E58F1A9CD3052F77AE19F3B712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245937, "uuid": "9debd957-778f-4bd2-b602-eb19853ef1dc", "value": "49152:h40raN2iCOlmxkH1VHU7B460m2tM/6a4ddWCBvq1s7gsx:i0ioibr7a4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245937, "uuid": "985d1f3b-38e4-484a-a10e-f433b5b0fd2a", "value": 3452928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245937, "uuid": "da0c3cff-f594-4744-961e-5149cf2d99b6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245937, "uuid": "7302b1cb-90f0-4f9d-8bf5-36e6ea962ff4", "value": "7cfc514481d2c36325b8a29f088dc365f0adc7b813b329722054c933a9a1aaf3.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309f938d-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220814, "uuid": "a5af5408-c48d-48cf-9b78-0b904ea1bbeb", "comment": "Malware payload", "value": "672084a89cef23fe1c79126e669c9461", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220814, "uuid": "821a0fc7-6a19-443b-a915-b05caedf6871", "comment": "Malware payload", "value": "7d7b0f1adf9ba9cc969530ec9954520f720feac67b0076f75975fc0f386613c9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220814, "uuid": "65eb901a-799e-4ded-9795-40e8a2bda080", "comment": "Malware payload", "value": "c14cea9085c9d48b700ce2c4f221dfcc2a01ef0f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220814, "uuid": "40daf3e4-f495-4d00-9291-06e712e0b186", "comment": "Malware payload", "value": "8e3cd34ea1a93ca5861a0c852d37322ce773629e4e64bcb69da91a3609e9f1e92b7dd7eb0047fd7bb13d2b6e66dc6762", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220814, "uuid": "64574e66-6b93-4463-81a8-70d624de12fb", "value": "T1F932C0CA874DE2A28A0AA0F381C60ED443193ECD571B521ABE042DB452FD5EAD9CF141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220814, "uuid": "e04ef51b-5b0e-459a-b857-a17d0b799938", "value": "192:JyiH3Abtinsr1SQP34R2C1TAh34IpJWNFl66NSZVlqvarY4ULT02FMLO9x4Sa6R5:JNQxinCAR2P3UFU6WKQYRYa0O9x1Nu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220814, "uuid": "bd4ccc99-329c-4310-bd70-10fb13740461", "value": 11844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220814, "uuid": "c9b544e0-7911-4b7e-8490-2d57e47b5e46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220814, "uuid": "58e4b381-b996-4bb5-818e-c1e1c75a31e1", "value": "images_20260727_175028.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c57a9f0-8a47-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785217479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217479, "uuid": "a807ef09-d291-461c-b201-2af3eb20fa5d", "comment": "Malware payload", "value": "ae2102521c9ee919a914bdcf93caa94a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217479, "uuid": "9f06d29b-069c-4346-be26-372ba3c47ca3", "comment": "Malware payload", "value": "7e74a48ebaf713b7ecc828938a114bf32a9d3383aa51df88434b5a04a7f7915f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217479, "uuid": "9d54eb66-f10a-4acf-b00e-a01bc5648749", "comment": "Malware payload", "value": "4ebc8a02065eb06ef66d851727747f8cfaeb5aa0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217479, "uuid": "a7b7f92b-c6bb-4786-ab6f-d6b7ba20a1d1", "comment": "Malware payload", "value": "314e404c0b87f6efcab4d451f11707a999b3138144b3ad74291771e75471dfe27a63a66e82b27e3b2c01877e4b445964", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217479, "uuid": "3e50d647-0f87-4c25-bff4-4fe9059701b2", "value": "T15717BE45F2A252E8D667C074C166AA17FB7438BE03502AFB9AD099746F37BD06D3B301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217479, "uuid": "07028966-8a6c-4755-a7a2-baecea86fedb", "value": "fc88bc9682352dfaf769becc8004ae0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217479, "uuid": "5696512a-fa93-420b-a7b4-e953885bc5ea", "value": "196608:wrTP+eIOIvKRBVRB0EW8QkkplzPApX+1z/iMR052fM1fICRcyXo:qTP+eI1q1kfPAR+1z/hR052EJp74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785217479, "uuid": "b752d53d-ae25-450a-a079-067d81e691f6", "value": 18688512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785217479, "uuid": "51f6e682-1759-4203-9b1d-e2b231412ed6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217479, "uuid": "200d45b9-1c59-4da2-a595-b271d2a42220", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f309847-8ab5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785264755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264755, "uuid": "15b10e51-f5be-46f7-b8f2-b4c8059c4284", "comment": "Malware payload", "value": "ef4bebc790aacb3ed0ccb59844ceda52", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264755, "uuid": "852865b3-3ddb-45db-95fc-4e023083c8da", "comment": "Malware payload", "value": "7f4947195d352f01a517e5f472d3ae734d22b1d8a6fc5a69b42e6db42f9a11ef", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264755, "uuid": "95705474-b709-4684-904f-2965c5c07971", "comment": "Malware payload", "value": "cf525bddad87af6136de6a2ece8a3308f6b72ce1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264755, "uuid": "72b41ec6-e185-4010-aa26-2a8f0e88f723", "comment": "Malware payload", "value": "6d5e7cb10fb7067654f02623f08c4ca5a2c145fca253b19f4bae6b277e8948c3ac641616bbb6b0f57f95a6ea3419869b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264755, "uuid": "fe85ef06-a7e0-4670-a640-4368b2d28c95", "value": "T158C27D956A867C44BEC98A3E4CBD2B0D6DF5C3D1324952AC3D8B3C719C12F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264755, "uuid": "367ff722-84c4-4a6b-b033-678c3d7c9cfa", "value": "768:68vCB+25j6es8RZ9FYpMSUpi+20qUpi+20YQX:68l25J/d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785264755, "uuid": "aec42180-f086-46f1-a0f8-5d80cd3da661", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785264755, "uuid": "97d0fafe-54e5-4738-a2cf-fe0a9d956ac5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264755, "uuid": "c9a60c03-2a5a-481a-ab74-1db9d3f59c51", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3715f233-8ab5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785264634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264634, "uuid": "2d8030e9-19e4-4819-b0eb-6be1ee66b0f2", "comment": "Malware payload", "value": "8a1ddd54742863ba237b35a94ae97be6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264634, "uuid": "2dfe83cb-6fbe-4fb7-a273-a4753d16df09", "comment": "Malware payload", "value": "7f758dd54c10e678c40fc022fa61f8ea4dd9780070c3b1f30b8dc5163cfbc7a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264634, "uuid": "72a5054f-0b6f-4043-9e64-87ed76d690a3", "comment": "Malware payload", "value": "8cc036911a626779fa3e7e6ee9b00d9769946f2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264634, "uuid": "4fcf8a77-806d-4ef3-9868-62bb37033442", "comment": "Malware payload", "value": "c86b70d848c886bf0bebd64a19f40c0cb7fa5c26f20e43d5648264592f3dbe8870cfffdd33b13004b3f4a8b522847a78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264634, "uuid": "70f57505-7645-4ec9-9c4b-87d53eab0e8c", "value": "T1D4C30845F8508B17C6C612BBFF4E428D7B2A1758E3EE720399256F25378B46B0E3B146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264634, "uuid": "6c0e5a84-0b5f-475c-ae7e-c3ac5cae707d", "value": "1536:4cimfQEuBkkP4Qm2Kd84VxfNTTjg8DHOgLO1JiDpT8MlTjwyw2NiHk0VWkPMmgmh:PABbAQmG47B/g8DuI5i8ev4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785264634, "uuid": "bb754f24-1654-4dc5-b587-f05c7686c5bd", "value": 125612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785264634, "uuid": "adc22555-afd1-482f-b5a6-61dd63de419b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264634, "uuid": "25e114d5-9fa7-4fe8-b0d1-a539dcefb494", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e88b35-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785224315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224315, "uuid": "17680ed6-19ee-452b-9527-aafee3448a84", "comment": "Malware payload", "value": "7f5fd38ff1efa3c821749fabbd560dac", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224315, "uuid": "b152018a-608a-4362-b39a-d88c4686075f", "comment": "Malware payload", "value": "822263a18ce32a3f64b13cd96b5dee269db760f0fc805a4121d41889933c9c33", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224315, "uuid": "d4ee1ea1-de28-4709-a353-05dfd2992d41", "comment": "Malware payload", "value": "799732a22ffe6d2b64d7a8ecc61555b97ab3d087", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224315, "uuid": "11209a09-c091-4ebf-86b9-fb1051c111b6", "comment": "Malware payload", "value": "b00a5dd82f1a76b5c4abb13634fab1f904b2e67745054c41b130c2aaf76026110416b8785c1bf638a0a75a78b3e30f7f", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224315, "uuid": "e1f7da5c-947a-4e63-974a-8c145598ab69", "value": "T13E553332641F08B5CB208A7F4B5FD9B219E7A3386C610BB18F6E5B8A6557377CC0598C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224315, "uuid": "7eec113b-aaa0-44a2-9d50-e8e10a272a2b", "value": "24576:3/Ao4zLUc72NwPnlpJ0k7VVAk9glsO3n4eXlFDrOxADJgIdnAYzanIjebmWosuP:3ULx72qPnfJ7VVlAsE4eVRrOK1dOnlyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224315, "uuid": "09cc7f7e-9629-4093-a6b5-529bcfdcf9d6", "value": 1361560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224315, "uuid": "f43525e2-c140-41bc-8f97-c4d544aef76c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224315, "uuid": "6923987f-90cd-4725-8f28-d50cb8de0295", "value": "bioset0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb0ae0a-8ab5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785264917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264917, "uuid": "b5dbb169-5be5-4ed3-ba7e-3d8925fd2cbb", "comment": "Malware payload", "value": "29bc41f6124aa659725fb39fee074724", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264917, "uuid": "1ab350ba-2731-4bb2-9f5b-07b78cdcc841", "comment": "Malware payload", "value": "82fb67cb2438bd0265f4e06f974456a8b212b70d45f8f3fc18e04155fa45791a", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264917, "uuid": "248ccc07-ca9b-4003-83cd-a4f5837ac0f1", "comment": "Malware payload", "value": "5a6aaa8ec7c2ab5e034b8d13f9ffe3f84b9b5242", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264917, "uuid": "a91ce694-7d6c-4b97-afc5-5fe86ff2f7c4", "comment": "Malware payload", "value": "1a501e98285b1e10fa73704a55a627c3cb85bb56d997daacbebf8fb8ded31059a741911488a4a6f2ccf157b1502bcd3e", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264917, "uuid": "9b340956-9d2e-449e-8093-422df15c284b", "value": "T104D46C0B978E29FFD1A6D0B9C14505A2A92274421F70EEDB53C19E362E366D01F3B3D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264917, "uuid": "9d87b5c9-9c73-4350-838f-f04a12354459", "value": "314d8821850121a2699e6f8c98b72945", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264917, "uuid": "19ac88b5-7d39-4f9e-b42f-4f0390e28fe6", "value": "12288:BppbQrmufuZME7S4AQrn/pTcmbKLbKOabsDfeVYugvzs5NzQjCTI:IA+bKTgW7gvEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785264917, "uuid": "06e36f80-30b8-49d3-a9ed-19705ace8e2b", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785264917, "uuid": "5667ca89-4fb6-49ed-b007-8858a616eb53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264917, "uuid": "ac4d8b7a-9e21-4f66-bc22-1f0012764e09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f860b8-8a97-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorphiex)", "timestamp": 1785252036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252036, "uuid": "3db65c82-cd50-49c3-9e8d-47f40a13a73b", "comment": "Malware payload (Phorphiex)", "value": "706e4e3277a565232ca3c363299b032f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252036, "uuid": "26f088f3-ab84-47c3-a1ce-a9d22b56453b", "comment": "Malware payload (Phorphiex)", "value": "83723bbe3d6116bdc45de533d7c890ab627bc18531d2c19d0d199e5151627fd2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252036, "uuid": "f6d3710f-604d-468e-b87c-4ac6fad445bc", "comment": "Malware payload (Phorphiex)", "value": "bd63550dd0a27ee22f3abd12e1d1a5bd782eecb5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252036, "uuid": "979dbadf-3210-45c5-9fa2-249f0a556ae0", "comment": "Malware payload (Phorphiex)", "value": "76560c84f0a659c8eabc2585a004e619cda86fab26ae2ecdba82fc1f70b2d05ccf704bd4f7e19a5cfd61b9e497040884", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252036, "uuid": "dd045cce-349c-4390-b69f-dd65eb5a4ac4", "value": "T136623B0BB8808036EBE04475827F526649FEACB623D0F8D7FBA068C959B46D1F43516F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252036, "uuid": "25d70de7-3742-48c3-bdd5-0e943922d7db", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252036, "uuid": "4e0ac1d8-0e2f-451c-9073-a6319fab34d0", "value": "192:AWisGnjXgjk8LcRI+AxOsMhofpF5oIV5ixBKUSf0zQA8FuixgJxTmv8U9cth+N9X:ArScx6fproKn0t8Etav8U9c+nX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785252036, "uuid": "ad4bedd3-0bb2-42b4-9fd5-63ff94a61789", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785252036, "uuid": "57596a90-de88-44a1-9896-6e3a5dbd1079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252036, "uuid": "84727aed-cd86-4c71-b085-02ca9a145d52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe076776-8a26-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785203550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785203550, "uuid": "b40de22a-ffcd-420e-94d9-e6e157dffc28", "comment": "Malware payload (Efimer)", "value": "9dde2022d383851518ce67221f6c3f51", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785203550, "uuid": "95a13a48-9d04-41a7-a342-231337dfce9c", "comment": "Malware payload (Efimer)", "value": "83801179bc16c5d1649aff7f6f7bbe46a2e6ef39ec4a3d3d558e758ba89eb7f5", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785203550, "uuid": "d41d142e-c96c-4558-a9f6-e65a4d6047aa", "comment": "Malware payload (Efimer)", "value": "78b10ae2f8b49387b8d68cd1c02f830f3243dd7c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785203550, "uuid": "727d7ec0-265a-45da-ad71-40094972f8d4", "comment": "Malware payload (Efimer)", "value": "e96546275c6d3d0f0768c0d0b27e4f188238a6772d688f176b1f25bf05de699b724235885636f93bc1f6d656be15cb80", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785203550, "uuid": "1befac5e-f761-4c91-b8e0-381e7bc10c74", "value": "T1BCE6335872C402EFE96781BCCCB11366D77978A10732C98B5FA847926E271E1CE39B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785203550, "uuid": "001df380-96fb-469d-a3ca-5362b1f20d2a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785203550, "uuid": "2cdaf78e-1c89-443a-a805-91c6bd87dbe0", "value": "393216:aAJtOG5q2rwYTWXMCHWUjXdcuI3/PGTAI:aehRMYTWXMb8XqH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785203550, "uuid": "46e7c127-a322-40aa-8bad-1efd1d5d9201", "value": 14269779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785203550, "uuid": "71dd23f0-51cf-46cb-b168-82cb0f55f32b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785203550, "uuid": "1cdca7a3-ed74-40a5-b20c-9eb9f1846356", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f629a02-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233214, "uuid": "7620c9df-0a4b-4244-b1a2-9b4ce1ee8439", "comment": "Malware payload", "value": "fc5297c0578233ed93e57c10489990d0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233214, "uuid": "d0622d76-e4d0-433e-b3a8-71b46ee086d2", "comment": "Malware payload", "value": "83e8e2ab7efd9b050158d38bec1661354074d763f8a2dd44729203701e27b3cb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233214, "uuid": "b3d6c26b-6b3f-4f53-bea6-128eeb0a8071", "comment": "Malware payload", "value": "aa3bd33a7a19581b08a8d9cbc74ce8a35f35a4d9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233214, "uuid": "413e35a5-dfbe-4812-a413-1837ec02f429", "comment": "Malware payload", "value": "03f1785170bea408160d8995ea6aafe7ccb9322e0247b0f6f62058e3a404e514c1716a0d8bbef775feb954b9adccc11c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233214, "uuid": "25b3eeb2-fc7b-4465-82c6-1115ff78f049", "value": "T12AA16EF54194D256DC9F0E70A2DFDE651CADE7F2A2038C6F401C4E60223725B31A85E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233214, "uuid": "991bb027-d614-4ab4-8757-c06cf6dc3427", "value": "96:JZtbxVpuhCjdoqNN6zHLKh/bVGk0wY5ezAsuZ+o8svzl4GEWrnv:ZJJjdoqNNQklwfTrTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233214, "uuid": "47657c0f-bb40-4b6a-8459-1034f7a66a6b", "value": 4947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233214, "uuid": "cb653ea3-3f7d-4259-8182-d832e7e91e35", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233214, "uuid": "b0b7ada8-88c7-471c-814f-acf420664b7a", "value": "images_20260728_001022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0861b4-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220755, "uuid": "e7a402e3-af39-4a6e-bcfc-220641aaf5de", "comment": "Malware payload", "value": "c33cf5405260c98a74eb916b2f5b3b6a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220755, "uuid": "4b77f573-2b78-4bc9-9c52-c95aa8c9e823", "comment": "Malware payload", "value": "84808d9866e5f5a0a5a06b60287f473d8fe9762dd3ff220cf3f72c122921bd47", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220755, "uuid": "226f2e70-b261-4309-a666-7d685fa8f3cf", "comment": "Malware payload", "value": "2bd2883c4f5c8f5c8f14702403cf739efd913fe8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220755, "uuid": "16168d7f-0a12-445b-97c7-09661307b207", "comment": "Malware payload", "value": "55154120e69592c81c6e8e5527c97f4c3c03cdf45225463fd74ff51458e95b99b55a1693582e47552813cb83ffe36f31", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220755, "uuid": "405d489a-962a-4261-b121-f74a5f8ab0aa", "value": "T12B411A648F1B30C2C8C1763031E92BF4120F5AE54B02F6964CEE27BE0D1E2202D80D5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220755, "uuid": "9763c5bc-ab54-4404-87f7-ee4c83c89d7f", "value": "48:9ye6eLTnKdaoVXcnAaEeXNX5hDWMW4+yAK3YZhYWZ8OJGgM3:cdqbKayqpNndWtpZhPZBW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220755, "uuid": "49f55e08-6cd2-4738-9f04-abfe184e7cd6", "value": 2340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220755, "uuid": "c535195a-ab4b-476b-98af-e69bfe6bd128", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220755, "uuid": "da4bec0b-e3f9-4365-8bea-7c3ddaad3597", "value": "images_20260727_105423.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ed0099-8adc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785281708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785281708, "uuid": "34568ecf-5cef-483e-8f30-1c582845e86a", "comment": "Malware payload", "value": "f33d1d9e1ab34026cea3f95862f0798a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785281708, "uuid": "a363fe83-a315-49f1-ae10-da0bffb5303a", "comment": "Malware payload", "value": "84b4c113491f67bf4a0c16629f003325575dd34de7120b4f94541544a1498da0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785281708, "uuid": "b8037e1f-7423-453a-bac1-4ae39bb9c4fa", "comment": "Malware payload", "value": "36837d1116f2f06cb43d1d0958cba70fcdc3f4fe", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785281708, "uuid": "dde99df9-8875-4643-9c4a-47888ad87a58", "comment": "Malware payload", "value": "68db87fddc592e16aa0a6ea1a02f33280fe5f1ef270c9b138813c3424d4aade4a695862a238867aaf9e649b77def5dc7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785281708, "uuid": "6e63f371-95bf-493b-a257-1eff5fe197bd", "value": "T17D623A0AA4818035EAE04075927F526649FEADB623C4F9D7F7E0A8C94DB4BD1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785281708, "uuid": "ce45d266-c6db-4468-a2d0-975231ef714b", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785281708, "uuid": "e0a5ae24-bb9c-4516-b2fd-2f42f49b4783", "value": "192:AWRsGnjXgjk8LcRI+Q1RDMRYfV/F5oIVUBKUSftzQFBrfgJxTmv8U9cthDO9ik:AkScCRfV/ro6toB0av8U9ccX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785281708, "uuid": "0a8a7f04-beba-482b-bb92-57a468916b6f", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785281708, "uuid": "88c4caa6-2ebd-4d52-b784-d158f9e8a378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785281708, "uuid": "4e665d6c-4375-4486-a443-dae650cb21c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f4997b-8a81-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785242323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785242323, "uuid": "85647089-5bf3-451a-91a1-b9d7fff469f6", "comment": "Malware payload", "value": "632dd008ac683a5e5b581cff45b31b3b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785242323, "uuid": "91a267a6-f241-4ecd-8c87-6ad18102f667", "comment": "Malware payload", "value": "852ff6f0791d4660aeebdb9f0e1c8cf1224b4cf33c704ad59160581e5ae72abf", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785242323, "uuid": "29d92a78-d54f-4afa-b82d-80b1ccdcfa7b", "comment": "Malware payload", "value": "a9aa1e4b137567128f6e09a883a636b98db3c9b6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785242323, "uuid": "f0783c67-0f00-4e76-9797-4331ba58c557", "comment": "Malware payload", "value": "9f4e5b581d976dd29b32bb545bc41c803d5e9aa3c7463ce35db36cd038a1288126f756b72ba27a503609b123fd6e3a0b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785242323, "uuid": "b4e2b82a-0c7e-4ee3-b619-7717a8b6be7a", "value": "T119863394B48A07F6D09BC7318851A99DBC3A7FC67E76DD0BBAD838111E33310867A359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785242323, "uuid": "6845962d-cc23-49ad-a91e-849bd348afde", "value": "196608:hTVoUCDQACnJd+Ib/82+nJ09Sk2nF7bsvTCEAdhDg:HoB832h737mTFAns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785242323, "uuid": "12990c96-c471-464b-8869-49c4099e1034", "value": 8200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785242323, "uuid": "3f26a887-b8a1-449e-9f20-038aff54fe71", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785242323, "uuid": "0e5c19d1-7f8f-4a97-9f49-e217b3ba3ad8", "value": "Install_28sn023.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6143f0e8-8a47-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785217460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217460, "uuid": "e2470b77-cfd3-4878-8e5a-daf2483327b3", "comment": "Malware payload (Mirai)", "value": "80df2c822de3f0de91cccbeb8b48692e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217460, "uuid": "6f03f8a9-4f42-4977-b83c-a809a0d78dbf", "comment": "Malware payload (Mirai)", "value": "87077f60cb68466066f3391f4af8e5fdd902eddf3cabe36f87fda34f9df8340b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217460, "uuid": "47c087bf-1f83-457a-831b-4ed9b72556ae", "comment": "Malware payload (Mirai)", "value": "9e5ca9ffb6d388dd408e8b28caa17f1fd8d1d1b5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217460, "uuid": "d895ecf3-5d09-4b06-a5af-b3a44a75daa0", "comment": "Malware payload (Mirai)", "value": "f42de5b601c4910a03ded8d1cea8e87b02debde134ee4fe69ba1f5728e4a9e219d9bf2f8f96179ba836364de47ce6c80", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217460, "uuid": "08a7ad3b-1374-4320-9770-45ff8d64edff", "value": "T1D9016FD7D16195104059991E62A652D0B461C3C6074B0B78BFDCA83DAB98D14F466F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217460, "uuid": "044fa974-2360-4aa1-b95e-59a9bfe954cb", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHka21CM6YCFt23FCXxOChJSXu8CR5G6UauD:kXCKysE2hi0ziQvZohaO7hFjU6WvU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785217460, "uuid": "fb20021d-6439-4e29-a96b-cb4d71b0f167", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785217460, "uuid": "4e36731e-2782-4454-abd6-9e2cc68756a4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217460, "uuid": "ef4ddacf-f41a-4c49-b06c-4af082acda35", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3491c7d3-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233276, "uuid": "2f654b89-6904-4f9e-afd4-261a901ba78d", "comment": "Malware payload", "value": "ce57e69ffc160e08f73f3c12dd02aed5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233276, "uuid": "14f9f187-0ed0-4b4e-9df7-ffcc00cafb32", "comment": "Malware payload", "value": "876872c0fe3d4fc49a6b923f4f26165d6cf5ecb5c8fcf97a4e9cebf5eb31509d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233276, "uuid": "1856abc0-f790-4a02-82f5-4208585d9e9d", "comment": "Malware payload", "value": "a70146a2beaad3fcd2bd61c3430c3a488e061956", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233276, "uuid": "d4542890-f433-462c-a278-35b160204051", "comment": "Malware payload", "value": "80835654dca0082874f3ff80e0ff9c10e7753339d15749f234528ed1f0e19f62d31d20b5ab5a4fd6f40b2e8582426589", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233276, "uuid": "0c79f459-4bb7-4898-af93-5bc7faa9c52d", "value": "T1D9A16D39A19AEF79C4761AB132E32CCB326C9753C1B6C913719085910D52CA9F7103C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233276, "uuid": "2957daa6-3e1f-4eb1-803e-84a8eeb946c7", "value": "96:PryfpZ9qcl1PRzb4gWGLGCwwprDxLMv4fsPOm5yWlkzPn0:TyfHZl1ZzbHLGCtr24m5APn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233276, "uuid": "378261f6-93de-4ef7-af47-9c6f16f7c487", "value": 4751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233276, "uuid": "5a3cc03b-9db0-4786-9942-c81af8df9cb7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233276, "uuid": "e50347ce-ccfa-456d-af8d-85baf4ec3294", "value": "images_20260728_031502.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88564c2-8ab1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785263240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785263240, "uuid": "0c498c15-201c-421e-b283-64182d32d7d3", "comment": "Malware payload", "value": "fb37efba5d716335100469b2bd1602f0", "object_relation": "md5", "Tag": [ { "name": "TonRAT", "colour": "#1DE73E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785263240, "uuid": "51669e8a-ce39-492e-b686-7d45b3a0dbc7", "comment": "Malware payload", "value": "885e45a141aaba366ed919fae0aef40f465a1703fe8d657b12d3b3acd70bb62a", "object_relation": "sha256", "Tag": [ { "name": "TonRAT", "colour": "#1DE73E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785263240, "uuid": "495f14c5-7f56-4694-9496-4bc7f652dfcd", "comment": "Malware payload", "value": "ebdc8ad3b579d4e17e0b849616451cb4b4c40e9c", "object_relation": "sha1", "Tag": [ { "name": "TonRAT", "colour": "#1DE73E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785263240, "uuid": "6a7d889b-7603-4803-b0f8-ba8c455e1f83", "comment": "Malware payload", "value": "9f445e36116e3718c84d3b007e71ffba759238219c14167cda3c2f35bf5797678efc8cbe444d9c677034af70d9868673", "object_relation": "sha3-384", "Tag": [ { "name": "TonRAT", "colour": "#1DE73E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785263240, "uuid": "3b0ede92-f6de-4710-a204-243973c488bd", "value": "T1AB02BF8086B198FF9BBB1C313F63ED97A5AD61BDDC0266D686120499324A6434FC13E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785263240, "uuid": "ca2ab193-6773-4793-a125-6eb488672b1c", "value": "192:Gtm1BsS7dSHVCTuvgL0E0/dhS7xKU9fqKxBgliMs/PSI:xsS7dSVxoV4PS739fqKx/XSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785263240, "uuid": "39df3f4c-de9e-4e9d-9bf0-e0f5ae6660b4", "value": 8614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785263240, "uuid": "e46cc1f8-6adb-43ab-be4b-9035e144e821", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785263240, "uuid": "c2ddff4f-9b0e-4ad8-81e2-529d6cf1064f", "value": "images_20260727_230703.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4a1fb6-8a74-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785236781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236781, "uuid": "c4a34b0a-bdc2-47ec-91d9-d36bf7774122", "comment": "Malware payload (Mirai)", "value": "da41dcf2ec485ee8f122d5261496e497", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236781, "uuid": "51b5baf0-9dd0-4af3-b433-cf316e7be231", "comment": "Malware payload (Mirai)", "value": "887288881b06ee01ebbb41d6dcd3e55fb6aafdb16673d72a5dbaab92d2e39575", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236781, "uuid": "27be27ed-7faa-4742-b046-5dd3ca698f76", "comment": "Malware payload (Mirai)", "value": "1531a01563d7b9c922f3d2ce8bd8c064e198d4ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236781, "uuid": "266d584d-8831-4c1b-bd69-798a40efb0d8", "comment": "Malware payload (Mirai)", "value": "75d099bd89dc3d5c92f2ae142043c9712b0a58aa89ab6463ae57eb3e59be605b9d849929f35b66a1a57b03f19246a561", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236781, "uuid": "20b9ea6e-51fc-4e63-815b-6293befe8301", "value": "T13D5302781E261EFACF6AB379968411617B420FD2645368477D1DFA83EC8A215BF60AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236781, "uuid": "63d95208-5d25-4cfe-98eb-bf90ccd2519f", "value": "1536:Gezd6KHRqBUy4dN4WCXSKG8Sio1zm7dsoWad+7zvVJuy:GezUKHRqBUfdkXSKG8SioidzovvVQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785236781, "uuid": "1aced4b8-0489-4b91-99f0-8dfa915dc321", "value": 62421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785236781, "uuid": "fbb76438-b88c-43d1-bb47-af249884f18f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236781, "uuid": "ad6208a2-a548-4d8c-9475-af307f4df7ed", "value": "887288881b06ee01ebbb41d6dcd3e55fb6aafdb16673d72a5dbaab92d2e39575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3418df59-8a83-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785243154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785243154, "uuid": "e2bce297-1ab0-4e3a-b7ea-8de67f43d56b", "comment": "Malware payload (Efimer)", "value": "398bae29ba107b311eac608a7679da9b", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785243154, "uuid": "eb585d54-539b-4ac0-9454-2e4754c6e543", "comment": "Malware payload (Efimer)", "value": "88cb4873b9bfbdf78da245f0e0a622161fb00b26c15a32bbdcba1dfad53cc4e8", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785243154, "uuid": "65a03c7b-e7ca-45ea-b88f-1ad4c4d69b98", "comment": "Malware payload (Efimer)", "value": "ccb33809c6614c204f8cafd465834b99fc3e4066", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785243154, "uuid": "7694c1f1-d7f7-4022-9416-12ba6473e86a", "comment": "Malware payload (Efimer)", "value": "4b659a32bdbb1a672d1348288eed57eb59bbc1fb903d6b088b1c4f16c3f47d4b5e3ea8502f99ad9f67fa5b7bf1db29cc", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785243154, "uuid": "34761e5d-78cc-4a27-8584-21833c26d751", "value": "T159E6336893E000ADE1F3403CEEA16665E569B4B04771C68B57E893759D3B1F08C3EF9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785243154, "uuid": "838fb2de-3e92-4029-b0b5-125223453578", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785243154, "uuid": "5e1e475c-8324-48e2-812c-1a9cec716505", "value": "393216:KcWt2e+bbzUV5t9lMbvT5weEHLSCXMCHWUjX2cuI3/PGTAI:Krge6o5PAvlw9NXMb8XLH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785243154, "uuid": "6db7773b-ba34-4ced-bb87-c10803f4752c", "value": 14325965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785243154, "uuid": "6c2bb2e8-4162-45a0-9ba9-2bc92fc67bc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785243154, "uuid": "aaf2cc17-5845-48bb-ac5d-27c725e3b345", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd7244e-8a4e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220701, "uuid": "2fe632c6-1fb2-479f-82b9-06de1c09c616", "comment": "Malware payload", "value": "749abe33598fbadfad224b7aee58cbca", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220701, "uuid": "9deb7467-97f4-4b04-aba4-1b159c1a8d3e", "comment": "Malware payload", "value": "89e58d3235575545f5bba34cb433378a66818bb6fb7cdf379b5a2f6c49402bd6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220701, "uuid": "ea576d16-4460-4494-869d-26ceeeae9df3", "comment": "Malware payload", "value": "16a4ee34b9a8ecc8dc48d03b94c39ed395a8c24e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220701, "uuid": "824ddd03-3e81-4162-a511-f7d19dc6a29b", "comment": "Malware payload", "value": "d46897a8cc93583283d083e4ba2d1f47322f3ffd24d654454f4b5bb8f548563c57be388f77d7d2c5599fd175ea28e1fd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220701, "uuid": "876cbae0-050d-434b-98b0-bbdaca53683e", "value": "T11A815E59DAC3D89AB135303438D83BEC57B4B12C12C1B5FA5337E8C827616215AA8F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220701, "uuid": "2edc4451-b9c9-4624-919f-3d23467e7f08", "value": "96:go8FBfzMttY40WTLoomwJB41jsd7ymsKCwTRHLdi2d1fdfTK:8zMz/0YLiwSsd7yhrwT1Ldpfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220701, "uuid": "7d1f1f71-0e74-465b-96b8-1728ea3d2dc5", "value": 4170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220701, "uuid": "acff3787-dfdb-41b2-b3cd-a82343da6004", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220701, "uuid": "d5e65392-2b10-4638-8430-bd2f838cf761", "value": "images_20260727_073757.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8cef25-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249802, "uuid": "bfdda091-7058-4c84-8687-17e5dcc1a0a1", "comment": "Malware payload (Mirai)", "value": "05cfada8fc8cd469147fe9c9f6652a52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249802, "uuid": "1a1b3afd-c44b-43ed-834b-baf3cff48fd3", "comment": "Malware payload (Mirai)", "value": "8a41113366ea0261bca7e2af17abd4da35b4a984a932f1d601e18b41b003c3d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249802, "uuid": "843a514e-05e8-4421-a038-22b0fdc8cfbc", "comment": "Malware payload (Mirai)", "value": "dc5cec026150770765686022951f22276c140a83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249802, "uuid": "5fec6c23-c73c-4f3b-ae8a-35853a4fafc5", "comment": "Malware payload (Mirai)", "value": "ba910c62eb892babe5915a792bb673a41e079f041bf095ac8b9a0dae7fe227864991c5d550e403694abdaced2fb4bf7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249802, "uuid": "2370620b-bdb5-49c9-97ae-079df1a796de", "value": "T1A8731B0DD683D9F0DA9206F0105FFF3B9972C8E032709DE7D7E876E6AA616819042E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249802, "uuid": "de2f4309-2985-4471-9646-15461a262546", "value": "1536:x50j25fYNrxrkYD5KY03PtgIhdS8zK1HFz2Q:xz5fYNrxrkYD5KY0/tgIhsZzz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249802, "uuid": "3629aa2c-8da5-49a4-898a-681d970077bc", "value": 78424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249802, "uuid": "8fd90478-2d2a-41b0-a231-d2ea65a42bee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249802, "uuid": "be8877f5-ea48-46d7-b374-fc00b7907782", "value": "zero.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0eecbb0-8ac8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785272972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272972, "uuid": "821672b9-54f1-4235-ade8-8b6888cec880", "comment": "Malware payload (Mirai)", "value": "bc653443c459d8c85afa87334ca17851", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272972, "uuid": "1ac58778-0e93-4328-9ac4-756c41a4a479", "comment": "Malware payload (Mirai)", "value": "8ac348ba6ce78dc9e0003c0568be8341e736563504c1956ad9b30d556b564070", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272972, "uuid": "6e36bfea-32d5-46a1-9338-d392c71d581c", "comment": "Malware payload (Mirai)", "value": "8c601c76666d8ab9c2f71b49e851440b937ed486", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272972, "uuid": "290ea2aa-6d15-4f1d-bd5f-c9571df51fec", "comment": "Malware payload (Mirai)", "value": "814be80f302ef8948ddd0e1f740c58a27e28314cdf37f6f04b6d7b56a6e0a30ddf55a2a640fe8e451f442bea8473435d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785272972, "uuid": "57d7f69c-b275-4b82-a74b-d7c8e7a20b6e", "value": "T16DA3D81F3F619FACF3A9823497B74B30AA5C63D122E1C684D5ACD5042E3434E594F7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785272972, "uuid": "3c8ecd9a-4ee1-4f01-aa12-25a39d272e7a", "value": "1536:XfFZ8BcQlFGINSH7Ei9N15HUd/W8x7Q8puFgACbPaR0F/LX6:9oFGIYH73H1Gd/HbuFg/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785272972, "uuid": "ec0abe75-b9b5-4c00-ba69-6f6ea0cfb7e8", "value": 98172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785272972, "uuid": "f30448e0-fe8f-40c2-9965-197b1561b8ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785272972, "uuid": "6f7e5e82-6d2d-4696-8f33-63798952fc28", "value": "qme1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0555446-8a8a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785246342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246342, "uuid": "fa08a9a5-e379-409f-9140-54c2554b1fb1", "comment": "Malware payload", "value": "8f71cb0761b0e731a64425bcb9d2bbe1", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246342, "uuid": "f8ef233c-d052-4889-9e57-b83ac24c8616", "comment": "Malware payload", "value": "8bbc0746224ad17b620095368180af18814fbb4177463d94807d3ed3cb5bfa88", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246342, "uuid": "0d2b0b89-7e5c-4c23-8fa6-15bf45ce9d7e", "comment": "Malware payload", "value": "0a2cf2efd27a7511a922e5651521e33b07c308fd", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246342, "uuid": "a8728183-52a3-4d0c-9bf9-2f6dfc95a02f", "comment": "Malware payload", "value": "45a316a90856ef0a5ef82c5c3592d7b422ba510504217afef902ad4ea03e37b9024d9a2b90708b02143d457f216c9146", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246342, "uuid": "286fc6c1-a8f7-46fa-aa6e-03acfa90224d", "value": "T1CDF5BF96B3C46AEDC056DE399714F232C2B3B9234F76D1CA5A96C30A0A76E514F3DB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246342, "uuid": "5d863fce-3aa6-4073-97e3-abf1e22058f9", "value": "c9d6ab13d943908634413d42c642c931", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246342, "uuid": "91c534b6-ca0e-4b25-a031-d3807b7e5ea6", "value": "98304:nUC5ttC4ayAyxNlkyXFAQ0f3tIIkxSFC92dHxDw2Ty2wi911ENR1jIedgo3yHXW2:nhtC4ayHTkyXF9M3eb9cHy2Ty2rr1ENe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785246342, "uuid": "f5fd5d83-6713-4c88-b213-17a3c38ba158", "value": 3541504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785246342, "uuid": "7a7be4eb-4c58-4d07-b5a8-96b0ab4cbb65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246342, "uuid": "4684ae61-a2f9-4153-9931-3be9250d65c4", "value": "atom.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f16dee8-8a96-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785251333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251333, "uuid": "89751a90-2b83-4774-857c-4a9685962844", "comment": "Malware payload (Mirai)", "value": "fb4ca3b62d254352ef052633f214efd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251333, "uuid": "f3df4ea2-4d1d-4b6c-9df3-8c033e39333f", "comment": "Malware payload (Mirai)", "value": "8dabea63cc23d81a18df443012c108c49b7dbebbdc61a0b3db319b4880e8fa1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251333, "uuid": "c97da241-d264-4155-ab77-456ef0e0e786", "comment": "Malware payload (Mirai)", "value": "ee992b774009c9d01e9475e95270c60c88773f22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251333, "uuid": "36b3c479-e573-43b1-99b4-1e05a4b750fb", "comment": "Malware payload (Mirai)", "value": "b5bfd53b3e16bfa356df4c3f128e05a47e635fdbb8540c295a80b711f4ab1229635597cae6176e0154f959df86e2f100", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251333, "uuid": "c15e402b-ce4e-4da5-a859-79c182c69837", "value": "T1A4F30845BC518B16C6D266BBFF4D428C772B1768D2EE32039D296F20379B96B0E3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251333, "uuid": "9fb5d503-eae7-417b-bc9c-da8d5527694d", "value": "3072:KNurp6IeqGgrIgW5NJWAwZeXoQQuuX0iZL7knu6:KNurp6zqv67WAwZ0oQQLXxL7ku6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785251333, "uuid": "ba4a278a-a732-43d7-b75e-c222558c2844", "value": 158456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785251333, "uuid": "b292c52c-993f-4710-8658-c389abefecc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251333, "uuid": "9a45abf7-3962-4a5d-a7c6-1487d2bfcf74", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d02bc99-8aad-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785261261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785261261, "uuid": "21ffa45c-0b06-409c-b76c-94e650fcfa6f", "comment": "Malware payload", "value": "40ad3bd07568c98de1b82466bc3783e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785261261, "uuid": "ee788b62-8ce2-487c-82ac-734eaf234882", "comment": "Malware payload", "value": "8df36a81c2a9ad02bd7fa3fdc2b9b619cbde32b9b98fadf1595d82b478eaa62a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785261261, "uuid": "990599dd-ac96-433b-8ee1-a2df6edd7d7b", "comment": "Malware payload", "value": "1aa1ecfebe487106c58526ed99c600649c54670b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785261261, "uuid": "27040805-9fc6-4d4a-bc46-f7afe176c502", "comment": "Malware payload", "value": "c2820afbf70957f8994a9758668b1cd660864b28586e33e4cfcf001f9683945ae62746d0b3a2e7de91a7a6e9601c0069", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785261261, "uuid": "442a1e8d-d6ef-447a-bd5b-e8a117f9d15f", "value": "T11DD733ACD37CA478D465969DCB90D9B3C6E83621AC460DFB01B49BD0FEB0B7A264CD44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785261261, "uuid": "4fc36097-c9b3-4d47-b3cd-46d2815c1158", "value": "0c9aa527f272b1232c87f4113457d246", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785261261, "uuid": "c8de074a-a58d-41c3-a2bb-1360d1ed795d", "value": "1572864:ae7I4bOC+PzyConwaxPJr89n5sAfFN5Jl1D:aeyHAVSVJJl1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785261261, "uuid": "1cd5caa9-5c9f-4fdd-abbd-8ed399fc1217", "value": 63486992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785261261, "uuid": "15112739-3362-436a-b735-b4c3aa39bb6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785261261, "uuid": "cb9097de-d657-4bc4-be96-27bedafd2829", "value": "Rivex Suite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735de397-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220926, "uuid": "588f0959-1e77-4132-b56b-389efd66f213", "comment": "Malware payload", "value": "3c6cfef9d8661a8087db2663334e56a1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220926, "uuid": "e6cfc904-c276-4657-9271-120c3754c4af", "comment": "Malware payload", "value": "8e35d1ea66b97a2db7ee452a4fcfd18476122883683d895c778fd0a5a3ab9c4f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220926, "uuid": "2cf4200e-46a4-415f-9384-c75969539c02", "comment": "Malware payload", "value": "3b567ea9d0c137f44b65f208f01ea3c34e28b9b7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220926, "uuid": "94a4c688-993d-4388-a323-6024de8cb29e", "comment": "Malware payload", "value": "7b034eb1efb7e0930ffdfa52c5d32401341429e4bae59781fb1c61c4d5c3ebb42a9b4e71b9841ef1f9b73b5cb4db6436", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220926, "uuid": "c7f7fef3-6ea4-4676-9478-934e2658d1eb", "value": "T14B12C09CAC716113CDCBC5BD50EA5433A890092652CDB90BE8E7B75EE4942F171420CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220926, "uuid": "d3464ab2-a873-4d35-9bf8-b2efbf1f89ec", "value": "192:8WXGur20/AH4+I9uDi6FIPSeNTZjZY9yehkKuXPLe+BJDQ8:9d/B9ulFIPSeNTjYceS7/D/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220926, "uuid": "568c69b3-63db-446b-8e66-4a1b80914b44", "value": 9641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220926, "uuid": "b9478f97-785f-47b7-9359-eb2a6969ab2f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220926, "uuid": "9fa98738-ef31-4461-bd60-285e4c49e5ef", "value": "images_20260728_015926.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee01013a-8a20-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785200946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200946, "uuid": "46019396-8ecc-4168-a5cb-e0214e43e57b", "comment": "Malware payload", "value": "2593238631f66b4f8c9489e4c42a1650", "object_relation": "md5", "Tag": [ { "name": "cuttingedgefencing-ca", "colour": "#2C048A", "exportable": true, "hide_tag": false }, { "name": "Violet", "colour": "#37189B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200946, "uuid": "132e201c-4b05-4d23-87a7-38d8c75d9c4a", "comment": "Malware payload", "value": "8f65fe2615ab00886f1e15499343375021fe8cc6a10e56d569c4277d0e23283e", "object_relation": "sha256", "Tag": [ { "name": "cuttingedgefencing-ca", "colour": "#2C048A", "exportable": true, "hide_tag": false }, { "name": "Violet", "colour": "#37189B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200946, "uuid": "c0371a86-96e7-4e14-80b8-fd1e5a36ab40", "comment": "Malware payload", "value": "179dd650c652fc28ca132f354dbe193d4e892bef", "object_relation": "sha1", "Tag": [ { "name": "cuttingedgefencing-ca", "colour": "#2C048A", "exportable": true, "hide_tag": false }, { "name": "Violet", "colour": "#37189B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200946, "uuid": "a4051995-3794-425f-892a-a8cbc1484302", "comment": "Malware payload", "value": "8cb63b635291189ab355e1c714cfec647c7717cdbe9a5477d6386b16b0a3c6e4cdc1e77ec91cd75a82b71fc1ab9d2e60", "object_relation": "sha3-384", "Tag": [ { "name": "cuttingedgefencing-ca", "colour": "#2C048A", "exportable": true, "hide_tag": false }, { "name": "Violet", "colour": "#37189B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200946, "uuid": "fe863120-5899-4da0-b2a2-309ff0feb838", "value": "T1101423E3475AA2432B5CE08497F79334660B835790182BBE2734F936EEDD184DEF6906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200946, "uuid": "b7dcbb5e-e8a5-4c48-b2ca-716c6c5ada09", "value": "3072:eZApK/RU3FCjO+wTNq0hlx1AGKLoXh04iVF2SW3JQIjm6Y9Kgku6pdpzruwqz:uAeRU3FCjnwpq0hfDKEx04csS3h0jpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785200946, "uuid": "feba1e44-13e5-492c-b654-e7f68c1e9800", "value": 205671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785200946, "uuid": "92c91885-2803-491b-b2f1-e183eb8ba3f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200946, "uuid": "3d25926f-b94c-47c2-84de-4e83768b826d", "value": "Notice of Intent to Award.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aedb754-8a4e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220456, "uuid": "22408135-1ac8-4160-adbe-ba8abbeb085b", "comment": "Malware payload", "value": "279a63896adb7ee1534532a4d3d94ff7", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220456, "uuid": "047a69fc-a7ed-4ac5-bdfa-612aa09a029f", "comment": "Malware payload", "value": "904a8f66d8c6c26c86d9a698918b456943da3e5f6ba46897c59fb9670941ceab", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220456, "uuid": "8e0b59bf-cb31-4d13-a780-7e6d12252053", "comment": "Malware payload", "value": "131b9a39e5d61128b50e195b6d00cda5e68b6db6", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220456, "uuid": "5e8cc614-f67b-4073-aa63-4a771b58c74f", "comment": "Malware payload", "value": "82c44652f0ac826e6f827e0892ac31d2c51810e2679fb880ae25711d25fe065f5d74ac925e3d8930a0a517b19d785120", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220456, "uuid": "caa81e02-6996-4e0f-ba11-e925ea893337", "value": "T17141AC212FF10325E7B78F3498F96213A562BD06FF128F6E01C102D956A5611E8A6F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220456, "uuid": "2136621a-234f-4202-b2d2-9492ed61d5f3", "value": "48:8XmeKpUQ1scZTCxKNMPZpZ1WoA9fr4wqMUIA6q6Cax:8XOCWscZ+4NMPZpZ1xk4wXUl6q6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220456, "uuid": "bf7103a5-0539-4a87-a64e-ce219978c9c9", "value": 2269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220456, "uuid": "540c5d5d-f8f0-425a-a125-db9adf4d50c2", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220456, "uuid": "8469f509-0cfa-4878-8b22-97c37abd2d04", "value": "904a8f66d8c6c26c86d9a698918b456943da3e5f6ba46897c59fb9670941ceab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d1885f-8a7a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785239551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239551, "uuid": "198dd448-a581-4aa6-99dd-e7742c020e10", "comment": "Malware payload (Efimer)", "value": "1f6b1d72c0ce7791411926925d4f6f1c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239551, "uuid": "9f63f1d5-748d-4674-b346-74548e6298f0", "comment": "Malware payload (Efimer)", "value": "90a7dc10998cbc29704868b8dfe1e69a6f01a08032784f9506988d9558f63ca0", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239551, "uuid": "cab33768-b494-4b43-bbaf-84124d5bb76f", "comment": "Malware payload (Efimer)", "value": "c00fbc1f9ffa18934b889c1a06e917d6dd914107", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239551, "uuid": "0034cd66-5640-448b-b83d-1f8f985d068b", "comment": "Malware payload (Efimer)", "value": "bc3bec8d3a41abf215c014ddea989ab3a089e1494f5b28444030f414f126038de62206cc21cdd0976d17d9a735f0520d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239551, "uuid": "5e4d6e42-c156-47ad-8d90-9aecacb2c40f", "value": "T1D4E6331495F053BFE1B3913CEEE31548D6AAB0BA4BB1C48F6A6847A12D171F08D39763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239551, "uuid": "b2690910-b2db-4a70-8cab-e594753247f8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239551, "uuid": "3879a9c9-7cff-49d8-9756-38b3bd485a1c", "value": "393216:D894Ol6yiPWoZaaUFC8XMCHWUjXkcuI3/PGTAI:DoNKpoXC8XMb8XxH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785239551, "uuid": "7a835af7-1d21-428d-b124-8f5313881005", "value": 14288798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785239551, "uuid": "08472b5b-6621-4536-abe0-aa6c5b615a74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239551, "uuid": "1f3d4067-b280-41cc-9f47-ec37c5a8a88f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f787ffe8-8a6b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233174, "uuid": "a06661da-6aaf-4d96-a914-93f2deea684a", "comment": "Malware payload", "value": "3c05ddd4fcec16856dcf7ed6f8b801d5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233174, "uuid": "4cc2e98b-d53a-4ac6-8dab-81fcba3caf13", "comment": "Malware payload", "value": "90ca147f76493dbcaae85b8c85fa29742e86b5bb04775880e330b74de88790e7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233174, "uuid": "c10ab6b0-25ce-468d-85e0-8185ae7f2f74", "comment": "Malware payload", "value": "7a67038c8f7026867766be4f1090a7b0b6d5457c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233174, "uuid": "ab58345e-f950-495b-807b-b0d04add3d42", "comment": "Malware payload", "value": "a22c4475134411f1e69db435d05e9248bf0a0847c258c992a9bcdff025cc760e1fdaf3f58883c227c2e26efd13ccaf37", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233174, "uuid": "cb2a469e-e9c0-4173-8e60-51dd9d4ac61e", "value": "T11EB16CF8CB5968EBE3087A3AFD561499014EBB681BF226E49A9AA0498751F434463440", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233174, "uuid": "85f6fabd-6666-4bf4-a4bd-8a57b7a0c16c", "value": "96:K//ts7pPU9TYuvNN3CNBptMWJbVjIYs0a5PTTva8mJcMDF29T5DTJUmfV8nj:K/1opc9TtCptzW+ahTbo+MDFCT5nmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233174, "uuid": "78b23394-00a6-4b86-9f6a-ecae07ef6349", "value": 5106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233174, "uuid": "0b3376e7-1efe-4464-92c5-a0ff222b676d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233174, "uuid": "9ce4b3e9-84ed-4b1a-8a99-ca14d7ebbc88", "value": "images_20260727_122610.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5039ca80-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220867, "uuid": "b144a26f-c155-40b6-8306-2938040be1da", "comment": "Malware payload", "value": "d6dc477983d9354b29ccd670554c0a65", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220867, "uuid": "d97d8450-9820-491c-a338-3a2edd227c76", "comment": "Malware payload", "value": "90ebb0c4ecc0912ffd28fc02a80ece90605912411ef8e2b0c176f9062435e311", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220867, "uuid": "12becf5f-fe36-43d5-b216-417510699f21", "comment": "Malware payload", "value": "aa987032cf129b0080f17b34cdcea8a6ac14e785", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220867, "uuid": "709d8814-5dfd-4aa9-aa36-a54862daff43", "comment": "Malware payload", "value": "0ebcc72268c7566b4548d8a2464b0c1ae8ac02bb274a3e29f9a479ead9d7f550f225cf7e403d6800f5291ccdd1bcca78", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220867, "uuid": "9c084225-1c00-4987-9545-0d7178441bbf", "value": "T12042B065DCBF8FEFEAE608E59662ACAB571893F1411D72CCD5D8C1250F50E2809AB209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220867, "uuid": "4358a024-7f82-40dd-be3c-b2002e346575", "value": "384:6GchZcW0MdO8g/w39aTz/qyzP9Pq2XCWFBaL7hnoTFTOVn:6j6MdJoz/NRi3hnoJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220867, "uuid": "4ca9a9af-eaeb-443c-a0b9-46414fd59b49", "value": 13129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220867, "uuid": "fdfcce71-ea8b-47ca-b498-7ba800a1701a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220867, "uuid": "105443e9-ea91-4b13-b8b7-5ea27f030449", "value": "images_20260727_192716.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb11cfbb-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249823, "uuid": "b0afba8b-d678-48df-baaa-562aaaa5adf0", "comment": "Malware payload (Mirai)", "value": "83ad2b145837824b23b47cf1fbbf99c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249823, "uuid": "6e6053bf-bf9f-48cd-b2a8-eb04883be37b", "comment": "Malware payload (Mirai)", "value": "911ca5ae4c0920bf26749725b67fd8f532ba3dcf523e6d3fcf1a41897d1fcc8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249823, "uuid": "5909085b-c775-4730-aafe-90bbb0581ade", "comment": "Malware payload (Mirai)", "value": "ea8e9f38d0aa5ec83fffb149dc84417be8d18ad7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249823, "uuid": "604bf7ce-bb35-4d74-85c0-4f1db815c0c7", "comment": "Malware payload (Mirai)", "value": "fc9a49510624e65431983b6da2d2b0a66434ff8ce2c9a26976418412d81dd3ae147855397252e19dca83f5da9eee9de1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249823, "uuid": "16a39047-fde3-4753-8d75-749f8d10cc98", "value": "T133F33B01775C0407E2A72EF03A3F6BE597DFDAA031F4A145295F978A8171D32298AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249823, "uuid": "67902602-ca2e-4015-ae8c-c032fe27709d", "value": "1536:nLU2Nz4Po7ilsjLIt6ORQn8RvcWSxRRj8ZnRrNvAbv5ICq6gxJ6eqv65kggHgvoz:ngeDLItDQn21SxCRObkCgMp7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249823, "uuid": "731100c4-c149-40b9-862a-b017c04bc597", "value": 165176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249823, "uuid": "b2e92b63-76cd-4a85-adf5-5e9e92143169", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249823, "uuid": "513bdfc7-8929-4551-9163-0395a92c9662", "value": "zero.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d2b140-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249710, "uuid": "5df1b2c4-8a1a-410a-916d-e45ed244113b", "comment": "Malware payload (Mirai)", "value": "097d07c388dfe2cd10e4fb02111795a6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249710, "uuid": "ae62466e-1e74-41bd-ac02-1a74058b888a", "comment": "Malware payload (Mirai)", "value": "9128338ebf078240c85c6c7ac4123f31d6e2ee3e9dbb4542edc751216dbdd87f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249710, "uuid": "29ec2a44-678b-4675-9180-c3dbe57b044e", "comment": "Malware payload (Mirai)", "value": "6a79482b431fef2dbaaa70898e69f9eb77783736", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249710, "uuid": "57352eb0-ba63-4716-bedd-9aa8b3e22ab7", "comment": "Malware payload (Mirai)", "value": "136a9cd657e625e678d648c6d3443c0a950aa9b1207c45c9c2497b3d52b607da566011fc8875d1120f1b2273cb6c6d39", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249710, "uuid": "2db1b9e3-dd8c-4835-bcac-62e9b63224f1", "value": "T1330429D7F800DEBEF41BA77644230A057530B7E144826B3762537D6BED3E1A52827E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249710, "uuid": "c6db13b0-1de6-4b9e-9c24-79cdfcd14d75", "value": "3072:3ITVdkbzwSR7J1/5OTM6+2yf0La8PVUjbiqL62ai1J6DuwueMyyUjWA:3WGgk+M6+2rLa8OL6BHXWyyeWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249710, "uuid": "05f09ce9-7e2a-4315-af77-7bc5efada630", "value": 179776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249710, "uuid": "c874dffd-aef7-4ede-86bf-0ac968a276e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249710, "uuid": "dad3f764-6126-4524-b979-a83748a04a1e", "value": "zero.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01cf9bc4-8a75-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1785237057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785237057, "uuid": "4193f7d3-0ffb-481b-99b9-a0818ea84364", "comment": "Malware payload (VIPKeylogger)", "value": "c319b9a31221572b9c87f3a5333cb254", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785237057, "uuid": "229147f5-72a1-4fee-ad6f-6c5018b9ac46", "comment": "Malware payload (VIPKeylogger)", "value": "91313d8a526294ff250106ff790eb3a2e89da5d4a625aa81eb00fd1140af4506", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785237057, "uuid": "d96b7491-ddcc-4591-87c7-739af7fa5245", "comment": "Malware payload (VIPKeylogger)", "value": "7ba0e618ba84669ecdc8045a47171cccef00d60c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785237057, "uuid": "ef8d0704-863c-4115-9cf6-6497e2aa2edc", "comment": "Malware payload (VIPKeylogger)", "value": "4ed7e56f99c9717c5a40599f2fd04099126cbac0583578cd304ff591d09dae6b63d43a605ad72732b1acde26e22cfc5f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785237057, "uuid": "73895306-7091-4719-b881-1bab02e8d661", "value": "T1AB162B8E4DD3EDEF92F8D705AD9BE6800BAC050B4E1CAF03B53D4458CE5AE4E270556A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785237057, "uuid": "6a17def1-0cd3-43f3-8515-4b4ea5f0993a", "value": "98304:2ZlrzmrgT7PbcF9hmuZGOCHwgmXWns3hEAQdHq7MdkqQ5QeSrHVq:2ZlfmgKagGfHwgqW+o+P4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785237057, "uuid": "fdfd29df-f127-411a-a08d-286dc57ccd68", "value": 4058821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785237057, "uuid": "84566b07-6fce-4daf-a75c-12134725fd06", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785237057, "uuid": "d1dcda08-d3ec-431d-a4ea-425ea87cf32c", "value": "HAJLK987654345678900.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a83d3a-8a8f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785248384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785248384, "uuid": "addb4215-71ab-4cc5-bf48-b4665a4af82d", "comment": "Malware payload", "value": "b4fc6c084b1fbf0e0c65f09462724ac2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785248384, "uuid": "5edbec22-93cf-4deb-bdd2-a2f90f79d9d4", "comment": "Malware payload", "value": "92450bf51b463de0c9b3a690917883107d4c88f0b35d86ff173bff09e30cecd2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785248384, "uuid": "035b9f99-e8ab-49b0-8ea2-9308f47fc56d", "comment": "Malware payload", "value": "6bbdcf59c3de30cadbe6698b78456b5df0b704ed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785248384, "uuid": "6573759b-d0dd-4eb0-976a-26033501ed2b", "comment": "Malware payload", "value": "a30eebd711bf90548a96e9fdd2155c63c13dffb69655188a466ebeb71fe7752625a6069132127d059ca53744820b05f9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785248384, "uuid": "7c270060-3a4e-476d-91d3-5b6ffe223a21", "value": "T1A2E012CB0119A301495C5DD4387B54BD7A85C2F135937B59E50D8475DBCA52CBC23E0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785248384, "uuid": "fb98ae88-4e3b-4feb-9288-ed61eee294dd", "value": "6:LkjP8khELVBUek9Q8ksWQELLcBUekixh9yLcMBUekPxhbQxIMBUA:LkjPfhE3Uek9Q8ksxgwUekMhgLcAUekK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785248384, "uuid": "b8644160-847e-44a0-9b52-fa1373a66ff6", "value": 358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785248384, "uuid": "5d29ab3c-637b-440a-9388-cc32bb7d31ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785248384, "uuid": "a389c9e3-cdc3-4593-8ae4-fca9ce9d9a5d", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6568e4e-8a50-11f1-bd95-42010a9c0009", "comment": "Malware payload (QuasarRAT)", "timestamp": 1785221522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221522, "uuid": "7f627d16-6f14-4e2a-8691-4ebac8727737", "comment": "Malware payload (QuasarRAT)", "value": "2ac1f830806ce3bdd35cdcb957f139ba", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221522, "uuid": "90d07632-93b7-40c2-83b9-3390958420aa", "comment": "Malware payload (QuasarRAT)", "value": "9270d36aa57eec3d44dc2d66929551198cb8a31d0ef383a726c38b75ad8144ba", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221522, "uuid": "a716fb04-6a8b-48ca-908d-acedd5fb7b48", "comment": "Malware payload (QuasarRAT)", "value": "00f6a68fef995c15c116c48b18d9611db036c1e5", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221522, "uuid": "4a35f013-eff8-4498-b0ec-74e2ef853564", "comment": "Malware payload (QuasarRAT)", "value": "37328179b0496a2c2be63b015cd4d5598bb56e27f8295a19c54c45dbe3582caf9ecb70db1b52ff06b9fc46338730ef57", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221522, "uuid": "0341b791-c8d8-4522-9711-d8104b59c299", "value": "T1E1747C1373A8D67BD1BE173BE53206056BB0D407B712E38B5A6855BCAC123868D91BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221522, "uuid": "1c666abd-61dc-47f3-bbf6-28c72eb95d79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221522, "uuid": "ea45ee27-ddd1-4ad0-9a4b-280a02fd7730", "value": "6144:kzNHXf500MbHkuNarU5bX1z0oaGMHAM2S06:ud509kuNAUl1zEGMHAI06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221522, "uuid": "9b17482c-0832-44dc-929c-3f05fdea660e", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221522, "uuid": "c5e145c7-f20a-4f2c-8828-733f465d8d02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221522, "uuid": "5538a6b9-cb87-49c9-904f-43555dbb76df", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc29575-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249720, "uuid": "ddeb22f5-765f-439d-acdf-320544069800", "comment": "Malware payload (Mirai)", "value": "e59e72e50dec8191e34886945fc2bca8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249720, "uuid": "4689694c-8037-48f9-bec0-ec24d34ac35e", "comment": "Malware payload (Mirai)", "value": "9300ee0fb9907454bfe55240836971dca3b6aef46b9d92f9fe2cebaf4ab78871", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249720, "uuid": "629617d4-86cf-426f-86dd-a4524a68a7ac", "comment": "Malware payload (Mirai)", "value": "12305a7f5228f8ee85cf04863935c27bcc43a3be", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249720, "uuid": "816bad93-91aa-4470-a65b-71d4740d3004", "comment": "Malware payload (Mirai)", "value": "54b92c6bb252f69d3b7f19cb8d2b1b18fe3e93582cacff7becaae5abe0e9440037b77f43ccfdeac17dff0e1a61218d11", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249720, "uuid": "c3860967-cc08-4b6c-96d6-84bc0c521a05", "value": "T17A11279F4458290EDA038903F174E36FB22BFFED6EBA3708D6852563E04844071B358E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249720, "uuid": "eb83022b-84c1-4ba0-9d1a-0925c9475222", "value": "24:5wEREwgHTaT4aqgCvT3TXhqbpE/EE2qWE8EKL6RnJ6EKEqxBX:1aFzu4LgC7DXAbycDqJzsMNqHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249720, "uuid": "edf70911-885f-42ab-995a-3323e4d65597", "value": 1075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249720, "uuid": "8669eddc-f860-4bee-8f48-af975b3b5ae3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249720, "uuid": "0a661064-a595-4a9d-98e0-a0f835ae1c12", "value": "a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a333163a-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221007, "uuid": "cbd6773b-3853-458b-92a7-b75b96a4a580", "comment": "Malware payload", "value": "b5b2d2b2ca6fc0d60ca1742838962bee", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221007, "uuid": "e98335bd-3e85-4962-bf21-005dd8797954", "comment": "Malware payload", "value": "93303a0513c88774fee7d1d3c707037666a539b2f2b024ac2dac0af9cf73076f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221007, "uuid": "14fcdf25-a79a-4c79-82d6-6df8a16204c2", "comment": "Malware payload", "value": "b8e75a4c5af13ec3036e2c98a686057de18e2de1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221007, "uuid": "e57518af-9d70-4fe4-b2b7-3a5569ea345d", "comment": "Malware payload", "value": "124ff5214afcf5df79572f8f7780fd1bcda0c1f0827474d5e3079aa96ffecb85eaf18ef294e6ff260caac03266c824a4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221007, "uuid": "a86f0935-5b12-4982-94ac-5f474187ca4e", "value": "T17F32C006D0FC50A6E5BB9673DCF99C5E87189BE26117C22731080773EEAA401EC4C4A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221007, "uuid": "0a705d3d-16ed-4d32-8a2e-48861e7a66b8", "value": "192:s2xqf4gGhmhjBeZO1Rcnddi2eLqD/iitiIrNBd/5P2skAZ5YUCpv2XlWXxvFdnbh:sHrJjB+ORcnddRW4/iitvdxrPQ+lWXll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221007, "uuid": "82af7c9b-e81b-478a-92ba-8d9dc99cf5ce", "value": 11381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221007, "uuid": "50540e8a-f002-4159-bc97-f696b471de46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221007, "uuid": "07d31820-c0d5-4e8d-8b48-2a81c36b6164", "value": "images_20260728_021508.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aad469e-8a9b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785253419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785253419, "uuid": "183d3f5d-2c9a-4620-a344-6df8af43706b", "comment": "Malware payload", "value": "7cbf7f798f56e77260f65f54c0315921", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785253419, "uuid": "fbd42c36-b8c9-4e5f-b8b9-a144efec6aaf", "comment": "Malware payload", "value": "9345635e5ef122006163445db6ce9758bce08612644a85530ce3c298564a6a8e", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785253419, "uuid": "4fd739de-7a00-4b84-8969-5fc08f4c842a", "comment": "Malware payload", "value": "370c835eef45e6cabad303433d0057c81ecbe573", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785253419, "uuid": "da2caf21-a6fa-4edb-9188-5e0a07d90416", "comment": "Malware payload", "value": "170a13b360aded1a724caf6a16561b2e98df89bc4b5800db7b8f90b83c1c36dca1e7c790e59c697d89432cd91ee135b0", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785253419, "uuid": "94f238a1-33c9-497d-a8b3-1dafc15bf2f5", "value": "T117232907E93AEEDF4273581F038B2D3053167235212F61E5B94B3C0F5715AEDA662D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785253419, "uuid": "e267c166-f583-45a3-9b76-f03548da018e", "value": "768:Z1pEdrtg49f8+VmupbEJHwfvto4vkWU3jWHUMOrG1BsfQ72cWGzcWUOajmCnx1eu:Z7Edtg4R8TGbNd2WHUMOrGAkoY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785253419, "uuid": "f9c2ebde-8021-4703-a917-a37083c3f629", "value": 47042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785253419, "uuid": "9861055a-cad8-492c-9a08-7ca977c6c472", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785253419, "uuid": "46c80e1d-6d34-4352-9778-4b1c45eaf3aa", "value": "index.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7767ed9-8a50-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785221551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221551, "uuid": "e75c222a-f4c2-4b09-9965-f093e9af5b44", "comment": "Malware payload (Efimer)", "value": "07a303ec82a2e27132dbbefaabd33471", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221551, "uuid": "cc9c13a2-4e7d-4bbd-a97f-cc1dfabf0c93", "comment": "Malware payload (Efimer)", "value": "93acfa3e1128452e59dbd9d479265747718cd7a37734ecfefee4c10e43b06dde", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221551, "uuid": "e44c2125-9b0a-494e-9a6d-e5eaa8fc51e5", "comment": "Malware payload (Efimer)", "value": "f34e8b0e9a2d225ff6533aebaa91109a05f549d6", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221551, "uuid": "98162442-efaa-4ac8-a6af-f68bf502c875", "comment": "Malware payload (Efimer)", "value": "96f8fa3875ef336fcab93956522d30354ff1208907b1b1ede0c2a10e7e81a41befc3ede5f3deb96f3274dd3907a906ce", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221551, "uuid": "dcb16c2c-85fa-4d54-936b-e5354d90ec90", "value": "T1BCE6338896D001FEEAF3913CDED255B9D16670764B34CA9F9BE087B06D172E0CA3C256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221551, "uuid": "d590a837-07e4-4c39-91fd-653a25b52a00", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221551, "uuid": "cbb250a8-5247-4361-9e9b-ea89850d83c5", "value": "393216:34KvMQvVErO56Qin11wIwOVXMCHWUjXHcuI3/PGTAI:Ie90FVn1ZBXMb8X8H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221551, "uuid": "579d99cd-9cd1-4af9-bfdc-322189a76f49", "value": 14266998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221551, "uuid": "495dc1f2-6974-4cd1-b3d0-65ee61e1c30f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221551, "uuid": "7fc48a30-e0ca-4396-b023-520a741a9c70", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e4605f-8a51-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785221811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221811, "uuid": "beef7765-3893-4153-8d40-ea2308186a51", "comment": "Malware payload (Mirai)", "value": "748aba0223dc00236b84b8694b061090", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221811, "uuid": "fa6a4109-b2bb-4db2-84a4-c6e60699a57e", "comment": "Malware payload (Mirai)", "value": "94c19dbcf891556f0c7110ef135fb0caafd1d8452faffd2c2d173563805cbb1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221811, "uuid": "686da7c8-cb6e-4506-b030-9d1268bcc13e", "comment": "Malware payload (Mirai)", "value": "5e86d0ac177a148502b685448e41786217981ada", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221811, "uuid": "24d4cb0b-4a87-4736-ad3d-ac0922a6661b", "comment": "Malware payload (Mirai)", "value": "0c6bc452326ee3426bc59b2d7c2a83508f8e41675f0bd831639968d46ca1016700c52f39e6716062ed05e50a3fad7309", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221811, "uuid": "4d402074-945e-4a90-9ab9-c69d411fb6ca", "value": "T1EB73175AFD419F15D4D526BAFE0E438A33536BB8E3EE7102DE146B2527CA91B0F2A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221811, "uuid": "e11e4e35-2a64-4d14-bb38-72671815bf44", "value": "1536:Vmn+J9zGM5FE3NGfBC4XfvNWscdRbDRVqnr/ME0pMdl1GiNDiYbN3yLfhiaR:7J9qwE9ovwsMRnRVqnr/Mtc1DiiN3yL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221811, "uuid": "5c53692b-c261-44b3-bf19-369de9fc04ab", "value": 80396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221811, "uuid": "7103b953-43af-4ef5-9797-8aea3d76c4db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221811, "uuid": "e14b2769-fb0f-4724-b70a-8ee0a9d78429", "value": "0f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd5a0be-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233295, "uuid": "f99c2210-50d9-4a91-a50c-b5024fa44694", "comment": "Malware payload", "value": "3561ed9bb4785fe22878e831d630b772", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233295, "uuid": "fa6ff1a4-11d9-4b42-bffa-fd6735e25f98", "comment": "Malware payload", "value": "94f11f5c3fb791e79458bee0dcbf2359c7197df37db141886d79ebdb78bcd14d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233295, "uuid": "94a4815f-9bc7-45a7-a453-32482e338072", "comment": "Malware payload", "value": "74890a338ca6f5631bacdcf90a64d94b74de4320", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233295, "uuid": "3e58880f-dd12-4cfd-8ac9-640a144e44ad", "comment": "Malware payload", "value": "2f718905681307ece53b35ecd1b9b59efa2ec7f733e1336c44a35123c3f00ef0a30034adaea2561abeaa32616d9b9306", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233295, "uuid": "4f689b72-e361-4c14-ad00-c4daf160a6eb", "value": "T1A5B19E40B5C70247E4F6C0B726377ACA2D68045EFF7A47935C8B07EE2105843684E8BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233295, "uuid": "66d22184-b9f4-4af7-9ab4-04d1bb927b67", "value": "96:sKu+Tnd7Jn8zjsP46tLss41RC5uLAtMazNckl8WT+m/bgigzU6svMdQ/yQ:5u+R79DP4ds4Ga0ckzT+m/bz4U60MdQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233295, "uuid": "b3fe2790-0ded-46de-8247-6d3a566b72a9", "value": 5433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233295, "uuid": "b161e0c1-9b29-42bd-95b2-a70cef2a8c91", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233295, "uuid": "5b7c4dce-7b08-45a1-8a93-c9cd4a1232b4", "value": "images_20260728_081143.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb6a3f1-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221132, "uuid": "c08cb551-9acc-4375-8638-585fe58ea84d", "comment": "Malware payload", "value": "f1bce33ab135e0e89cfe526d030f86b4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221132, "uuid": "f1c8df96-b300-4755-9df8-6200aec4f917", "comment": "Malware payload", "value": "9592e5f65c1ca01c08736474db04849fe0172113e4eea1c70a9e8e1c7fbd4076", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221132, "uuid": "d199eab8-c657-4d6a-ac1a-2db94465ab11", "comment": "Malware payload", "value": "9d3ac68da9e73a118aa95128ec3a0ac2ce44ffe8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221132, "uuid": "5a1625fa-f30b-4806-aa28-64220f785146", "comment": "Malware payload", "value": "aeb6d2fa5ef5263ece65696d34d54fcf584f1973ad2c11803ddc685937f02b9bc8cb6d59e45b36439292bd6ad7278af8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221132, "uuid": "7d6a4fed-4d0a-4cd8-aa32-2b8a040e77e1", "value": "T1A802AF609A280F13DBDDADE1D2BE6C04722FBA8EA858F45246D43778D41E7C716414CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221132, "uuid": "d6a12adb-9572-49ac-859e-c1b226a6b673", "value": "192:vkP710hCM1rWUdWqDyVFSD2HQLcaqVz4WH9mEl8Hdp29Zb8:vkPWCsnKFSuB99Z0LyZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221132, "uuid": "ba0e4387-324d-46ae-8de3-b29d77e61900", "value": 8982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221132, "uuid": "2bc44d77-718d-4870-b9ad-7647a9425d30", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221132, "uuid": "3dd22271-f332-45db-8bdf-b00ee7717696", "value": "images_20260727_214107.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8229062e-8a51-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785221810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221810, "uuid": "4b3ac78e-fee6-4ce7-81e3-9c0c9ceecd53", "comment": "Malware payload (Mirai)", "value": "4365ab6203a529bb58c9079f1c392d5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221810, "uuid": "ba7e57d2-4b63-4eba-ad86-0d602e996d12", "comment": "Malware payload (Mirai)", "value": "959497c4484d8f737936b0edf9e56e9b8463983ec54f2c75518a67f5aee61ea4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221810, "uuid": "b9f57b33-caa8-4091-8951-ca78a14bd340", "comment": "Malware payload (Mirai)", "value": "f7d8d0d3ec4f70647b027d0394d3e72612db114e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221810, "uuid": "327f28d6-7813-40e5-8191-7699e7568c92", "comment": "Malware payload (Mirai)", "value": "149817693a5f0d38009c42c8bd0320a0d66bffb33f87e15f49f49cf15fa16b50bc6bd3858cbd27ade217f906cc2c5842", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221810, "uuid": "f675da17-1fcd-4fdd-84c4-183f6f880c97", "value": "T191A3D81F2E219FBCF2A9C23887F74A34965C23D123E5C684D5ACD5012E7434E694F7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221810, "uuid": "d1b5fdad-db12-43be-a827-2ffcd98311c4", "value": "1536:2oIVZBc8qlXNvXBk5gENiF1lHEdLU8t7s8puFmTNRaY0M5R03yLfhiaIR0:uEXNvS5gQG1idL9nuFmpC3yLfhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221810, "uuid": "5e4d03ba-63a9-45f3-86cf-efaf62d656b2", "value": 101132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221810, "uuid": "116631b8-2474-4c40-872a-3e34a4373494", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221810, "uuid": "479458a3-b5b3-4a70-912b-d0a4ce0b61dd", "value": "jST0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aadaab7-8a49-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785218281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218281, "uuid": "00602fea-47d9-401f-9693-e4395c7fda68", "comment": "Malware payload (Formbook)", "value": "4c67f85349f79167275249d56812e141", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218281, "uuid": "392b6972-29fb-4a64-ba9c-947e7cbcf215", "comment": "Malware payload (Formbook)", "value": "96adddbb37c0c217b80d89de18a28a886830792b4b05ee0f62404c2f82f1b743", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218281, "uuid": "5dac14a2-4472-479c-b803-0a5af449246e", "comment": "Malware payload (Formbook)", "value": "5e8a4e721c047099892fe15e320c1ac87439cab3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218281, "uuid": "f088e6c9-3684-4899-8870-ccdbd85a0c70", "comment": "Malware payload (Formbook)", "value": "a39829383853608711e882f41d939f6646a82c6ec55c3b9539ee9b689df1809ebaccc1edf073a09e7e380e3e7f8b902b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785218281, "uuid": "94f1c496-ca0e-494b-8735-f2481f6ee9a7", "value": "T13B658F7DCD18023FC2F7D21AC8CE8E47E8525A6F651CFE4550E7A3E26A63143B58216E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785218281, "uuid": "087a4a51-93a4-41b7-a903-4e31af8865ae", "value": "3072:ObUG40zk1va38D9YUkuIlv3gCtocfdyQcko9bBFjLt6Ot+AQCcg1/IXHUhMEzxsS:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785218281, "uuid": "91a379a5-86a4-4126-bb68-03a8438acf1f", "value": 1533302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785218281, "uuid": "838f1607-ffe8-436e-931f-ee0f74232a95", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785218281, "uuid": "a919d138-6993-437f-9248-d5af789c37ed", "value": "Whatssap image.jpg 27-7-26.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f76088-8a4e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220709, "uuid": "135b788d-a7df-4e91-8a36-3a218a9975f1", "comment": "Malware payload", "value": "6677eb9910095d62738a76330775adf3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220709, "uuid": "95692171-cb08-4c1d-8273-9a379886d4ff", "comment": "Malware payload", "value": "97bb0162f69ba1cac03cd9a375b3f5ae75770f8d370176675e2ceaac5055d793", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220709, "uuid": "610c69c6-8398-48f9-9bcc-e6ed4b080970", "comment": "Malware payload", "value": "708265b18a7c1eecb8c06b631e2f7f71aa0c78cf", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220709, "uuid": "bf15f2d6-492e-44a6-9fd6-06ed941a0125", "comment": "Malware payload", "value": "c3cb2abea060aae3cca005806b538551d83bbbe88b7de6d5f7a7374cd0fe316108e9286fff3f520925f32bf439f375cb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220709, "uuid": "2aa5f38e-9f4c-49ee-a3b3-d6962525ef27", "value": "T11372BF1D9F50EE6CB8099B375E04BEA7815921AFEFD1E1ADF0188F8FC72950962168C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220709, "uuid": "62d35d94-912f-4e5e-b650-278a90612bed", "value": "384:xQxHe7XezUdvXnGD52w1j5cd74giiMJwwFi7553:xQN+ezmv36v1jI+bawI33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220709, "uuid": "7cf88309-ccbc-4b85-90bb-740502e0f9c5", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220709, "uuid": "2e3428fb-49a5-406d-81ac-a46e49aebc88", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220709, "uuid": "532e1f89-c793-414e-aa22-a813ef657d9f", "value": "images_20260728_035943.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74bebf24-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785211050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211050, "uuid": "f7c64039-0052-427a-84f9-375415c5e902", "comment": "Malware payload (Mirai)", "value": "de0cc12ff7e094f1438544a64cb89e93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211050, "uuid": "5effba78-cdfd-40a0-97b7-c82a765cb373", "comment": "Malware payload (Mirai)", "value": "97cb64a765b5a2a9457ea5836e6af0363140ea98aff20f5a869bc0a97965e5aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211050, "uuid": "4c406ebe-7c79-45e0-9794-fcf5b8881533", "comment": "Malware payload (Mirai)", "value": "7cec10b2329c16f650c3a6475afd1a9c540718cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211050, "uuid": "4acc37be-1420-4a38-9ba4-12b40f458f59", "comment": "Malware payload (Mirai)", "value": "ce1466cf89f878dbd125297bd58b4bd87abe61da1dfe0e7b565a7d00548ee3e1f8f385cd480713af80e3df788fc591ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211050, "uuid": "9ea1a135-01d9-4f03-a9f4-3e21c72f7743", "value": "T10D2423BA6019A0A9DD8179A0BEC2B58FF65C131DB2EE119D643A43D3EFEC8007F34655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211050, "uuid": "735eb173-3dad-49e6-9908-fd2d9773b545", "value": "6144:Zv2ZvTzYGWrUsr6allkR23yz6hEqbtn5I7CPmiMZ:Z+ZbUPY3cdbR+mOi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211050, "uuid": "c3813440-9b34-4898-9532-9ed85645a01c", "value": 223984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211050, "uuid": "19cb50ff-3bff-420f-801d-ae3a84a249e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211050, "uuid": "e876dc81-a825-4721-8835-0ebe3bb3fb62", "value": "dlr.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0572ebd8-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220742, "uuid": "1b7b76c6-2a3b-48b3-a5f1-bc505dd9ffe8", "comment": "Malware payload", "value": "5c06aafd3d8c4474e1eac6754d4f5472", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220742, "uuid": "9e7ce882-031f-4563-8852-40688302962b", "comment": "Malware payload", "value": "989c2c7a07ca616f1f0f3cffe2fb9bcf0e34bb89f175de65e7ce6ff11f530d4a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220742, "uuid": "003c2dfc-a7f2-4cc6-b9f4-d24eab5ede0c", "comment": "Malware payload", "value": "7ef8af74146ae0cd91558ec4aaf900692f0a9d1f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220742, "uuid": "dd71cd55-bb39-4664-b81d-d672395a9a6d", "comment": "Malware payload", "value": "6182959e2aa789184ba67667ca9b0bc910949c6d69b3207949737b6e2c4917409f787cc009a5d55e03190f4e1890180c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220742, "uuid": "b175d735-d77f-42ec-bc12-8fd9f19c54d0", "value": "T16F029FF1CF638A59CE8793F5F2F12DB9110A06D12C930E99497C698CAEF4982C319546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220742, "uuid": "d653dcdf-0083-44b4-b6c1-de2bb3c10208", "value": "192:3GBqCPwEc7wONklR5QjsBMCw7O6GNkRgVkGbHOzX:2ICS3NkNQjPRq6OkwKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220742, "uuid": "425b7b74-4533-41f6-9781-07f69dc8b20b", "value": 8631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220742, "uuid": "de018ac4-489f-4ca3-9276-0791b6407c98", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220742, "uuid": "198504a4-8866-4fa9-ad27-079a4074080d", "value": "images_20260727_091627.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f55c4b8-8a98-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785252246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252246, "uuid": "f25953da-13e3-42a7-afd7-2182c2435eb4", "comment": "Malware payload", "value": "1668d47dc27aa02333ff205c7cf59a49", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252246, "uuid": "62252bea-9de1-4a7b-a7c7-e4098decf71b", "comment": "Malware payload", "value": "9978b944440d1cfbdcc7d79245e23fa048284d75cf6c6609ad1c1de01dfe6c09", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252246, "uuid": "da91f213-289a-4eee-aa60-56a4714e9489", "comment": "Malware payload", "value": "0a09aba6333498963e6a5925620bee600428c3c7", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252246, "uuid": "1a3435d5-c185-4a85-a46e-7c94027f4c46", "comment": "Malware payload", "value": "4771917d611bb72d810d1346d61960eb2db324545ad1ce5ba49ee9f51bc85d17095f6acee50dcbd82a79fa287d4dfde0", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252246, "uuid": "ef5fcac6-a3a1-4d15-b58d-31904589f9bb", "value": "T11FF00C162C5636518DABC8E6074DF1001EF8EC824A0A099EBA0431CE9E6DE28CDFF213", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252246, "uuid": "f44600f7-3f48-48cb-a5d2-c5eea093298a", "value": "12:iIem9TsvcW3KagPioMJDTnRdJBngmycxBihT8s2dYf4DRkshRh:RegwcMgiPDgmy0Q21DRk0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785252246, "uuid": "76f1b475-44d3-4cc1-b9e9-c6f26dea11c2", "value": 602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785252246, "uuid": "ae7ce3b4-a028-47dc-88de-41a250e7638f", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252246, "uuid": "0df04897-1dae-4545-8ed0-bb06e26514a2", "value": "244824index_1.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180b1608-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220773, "uuid": "f974d603-eedc-4b0f-b400-14a050fb4133", "comment": "Malware payload", "value": "f6bfffb4a714da9902a2f726e359f46c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220773, "uuid": "68edad78-ebb5-4bf7-ab16-0e81b65c1f86", "comment": "Malware payload", "value": "9a3e1b06be5a6911f8f1f6656c4224e6436c6dcac355b869f5120476b692504c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220773, "uuid": "a088356e-deda-4778-beb3-97852add336c", "comment": "Malware payload", "value": "432714ce871d79455c90b16d2e6a4fe4f3d6684c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220773, "uuid": "78ce3ac3-2fbf-48cc-a0b2-9267526fa6b4", "comment": "Malware payload", "value": "210c0fa65eafc3917ca17501fc655319cdffbf0489d7f7062023b0920b2ad96230ad7563efe31c520af4b2c1cb755dfe", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220773, "uuid": "47ed00d0-4576-4f5d-bad1-98010a08e5f4", "value": "T17D512B8056B75863C1C17B3723DAA9BF7962A0AB6247084696DD4363B32F702CA4E954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220773, "uuid": "00310f80-b8e5-4b3f-8586-4dd39ce7212a", "value": "48:9LsgA1S07IlOwwuwxym9943fOeI3+OpnRN3r9BYw5xri0A1H75LSyRMraMejoetR:vxmIc/ZZ9943fOeEn3rT257yUECz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220773, "uuid": "84d56d93-6c9e-493e-a650-fe40c13ff816", "value": 2772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220773, "uuid": "65040a54-de0c-4ee3-8da2-97ac50388b3c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220773, "uuid": "0130c2fe-6e95-4cbf-bf9b-404eccac16f2", "value": "images_20260727_071734.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282148ba-8a49-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785218223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218223, "uuid": "44eb57d1-984e-4501-af26-6abc2e30e99a", "comment": "Malware payload", "value": "680ba6eed79451b098df69fd36c3ec81", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218223, "uuid": "469fe3b2-fc52-42ee-b7b7-1e2d412253c1", "comment": "Malware payload", "value": "9b7aa5e5a10bf9491cd0d46674fb6f5b96c0149ee903bb972b3669047825bcc8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218223, "uuid": "890575dd-27ba-4eb8-8775-6ea4eadb8dde", "comment": "Malware payload", "value": "3d1707718a503333161ea0fc4f3a3cf60326b60e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218223, "uuid": "f0950c44-4c39-47ff-842a-9959bf141291", "comment": "Malware payload", "value": "8f23ae661f48f507367a11ede5d1ca2f8af4df94e7fdda533cce8d3b56b5a3bc866eadacf97cc262d5837217b3a9cf05", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785218223, "uuid": "af5d7747-5e9a-4564-b8ae-b46e7d1ec9f1", "value": "T153A591CAB291991C77302F250C35778B74B5B3A81D46EA592F1FB44CF4DC8AA8B578B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785218223, "uuid": "cfd6f693-f4fc-41d7-be23-799ba7912b5c", "value": "192:5fDfDfDfDfDfDfDfDfDfDfDfDfDfDfDfDfDfDfDfDfDfDfDfDfDfDfDfDfDfDfDX:tua7m6sPbTHIR1PSjt6kUZj42n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785218223, "uuid": "0867785f-f2b4-40c8-8729-0311baf898fe", "value": 2200451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785218223, "uuid": "3c2cf392-3e50-48e6-aed9-0eb9a07514fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785218223, "uuid": "d4e054a3-f102-4108-8033-aab80d53c810", "value": "SENARAI BEKALAN BAHAN MENTAH_BAHAN PROSES KRITIKAL UNTUK PEMBUATAN PERANTI PERUBATAN YANG BERISIKO TINGGI_28Julai26.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a62f5a5-8aa0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785255647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255647, "uuid": "3755abe2-50c4-423a-a7f0-e74e5b11e44c", "comment": "Malware payload", "value": "97572adf6c68b72cd99d2079cd814f34", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255647, "uuid": "dd6daa91-9766-4ced-9d47-88ad5c22ad57", "comment": "Malware payload", "value": "9bff25383fd1cddde869327b597cc322a0749e7a3fb55485732133538acb85b2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255647, "uuid": "ea374dfe-6d9e-49c7-9d54-3ac44b8dde81", "comment": "Malware payload", "value": "2cdfb0a589b0bf08650fb10941b4399f111724d4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255647, "uuid": "691804d3-b10a-4c40-a093-0812ea039673", "comment": "Malware payload", "value": "77033f7a0821affe99c7f41a0ca986dba677ec71572312a0ee1f21db36f8eefbe7d50c71fecece377ecd70ff390951f8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785255647, "uuid": "4379eae6-ff0a-465b-bafc-7acbe95181af", "value": "T196C02BD5FE06C438F4496A3DBB4F04291E81B2D7046B7C18A043F52EE00D60C3107608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785255647, "uuid": "b70b2b90-9d82-4d9f-a08f-e32af8b8246e", "value": "3:TKH4vABa1gvZPsW6RGKXWSAgKy8baObQB/+s5FpJ/RJ0uTQMe3n:hUvyNPGS/QbqB/B5DNRfna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785255647, "uuid": "68220bdf-63a6-46c6-96b8-68fff91a0d44", "value": 150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785255647, "uuid": "ed0501af-2b80-4b5b-a44a-43dad46b3173", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785255647, "uuid": "05ddae70-2c5e-4f5f-8085-3cb2d0eee193", "value": "9bff25383fd1cddde869327b597cc322a0749e7a3fb55485732133538acb85b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6da8236-8a4e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220717, "uuid": "42138dc2-6238-41dd-a82d-c697d81c3f68", "comment": "Malware payload", "value": "0fae071ee39c5bfe0b9ae45c976b6520", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220717, "uuid": "63a65682-e8ff-4730-b6c1-9c8ca17423d8", "comment": "Malware payload", "value": "9c3d9e77bd4bdf986103793410f422c58b497dae974e2393f04a888df2399de4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220717, "uuid": "be0752a6-27fe-4c83-9224-9a1b8382a74b", "comment": "Malware payload", "value": "16df5f3f20cd31ee6b0fefe68c095b96198b24f1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220717, "uuid": "8ee95d43-da2d-4b44-b3cb-4b08e61f947c", "comment": "Malware payload", "value": "29f84d79566bb99d3de35b4f289a3e38d13c1f6f253962cc795a44f73e8f21b3b71081acfe927b3d57004a7e94e10494", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220717, "uuid": "0e281013-be1d-458f-94aa-66006f61428e", "value": "T17C42C09A11C422CBCADF79F5909D24B7A67D770A0FD0D536984F6605C3A3BB8AD0B207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220717, "uuid": "6f417aae-c291-4d63-a73e-6129fbf0be16", "value": "384:/7gtwdOenVVRmb4GaFLvLuknxp9YWSneV:/7OwQkA4tFvy6x0WSn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220717, "uuid": "65e442b5-628c-412b-b443-3670bdefc133", "value": 12781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220717, "uuid": "285507cc-f7fa-42ce-bbf5-430cd4f680d6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220717, "uuid": "a352aee7-9a2b-4754-a00b-76c529d8811d", "value": "images_20260728_041812.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e900c5-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220828, "uuid": "26f0e639-d6ea-4aaf-a38f-eb7b607accdf", "comment": "Malware payload", "value": "2ae2d2a30e15820bd6e9f6347e83c646", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220828, "uuid": "214d91f9-d09b-4503-b993-32e255befada", "comment": "Malware payload", "value": "9d65f1630d25a97e24e05576c90fe86fbc2278bba54b0c7d6d33ad507e4eb369", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220828, "uuid": "ed1eba24-1026-43df-8ba4-b7c5c27f3ace", "comment": "Malware payload", "value": "ea9e004772477b40c17bdcbd5f9e19c006f0e329", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220828, "uuid": "8624067f-c84b-469c-9688-70ba5db7cf9f", "comment": "Malware payload", "value": "d95bb4613c12136cf7f783b29a3d41f0b49977184516f303d7382e6a96c4df5bd57a1d8f28ba8d30c7ab3aaa7a0593ef", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220828, "uuid": "96f6abcb-9180-49ed-8b44-3f0551119622", "value": "T15432BFF8CA536110C9DD9C656BB5868A88A7D6DF0B78D03891F04F057B517B103B19A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220828, "uuid": "68a9b6a5-7c62-4810-82b8-4f3e01b76fa3", "value": "192:3ao81gL+DIrPFqMNKHDprPB93VUby+lAfC9aqNeu7L2+9XICgt/z6p74:Kd1gL+0r0WKjp7BMe+lAfC9aeeu7LaCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220828, "uuid": "aceaafd0-14f5-4bf0-939c-8369fca26626", "value": 10949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220828, "uuid": "0286b389-41bf-4783-ae99-168281c8d7f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220828, "uuid": "a36e2b0d-32e9-4a8b-a4fc-f6b0ea2ea4d1", "value": "images_20260728_003200.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75a33e6-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785245951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245951, "uuid": "789ec239-11f4-49a8-8cf3-c4c1d7160cda", "comment": "Malware payload (PureLogsStealer)", "value": "ff6d85d0d0c41603ab595a92f6aab474", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245951, "uuid": "09b826a3-625f-44cb-832b-162f10624b2d", "comment": "Malware payload (PureLogsStealer)", "value": "9d7aebba3271d1d00dbebab0e608f329c0bfc40bbcc34922419a191728d05248", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245951, "uuid": "9b4d854a-077b-4ba1-ad3a-6085accd5ff4", "comment": "Malware payload (PureLogsStealer)", "value": "ea83c8dcaf64e71f28d276ced5d5e7ef5575ce68", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245951, "uuid": "a60caf71-9ded-4e36-8512-4ab4d3d86048", "comment": "Malware payload (PureLogsStealer)", "value": "e202ccaab675a598547849cb394ce9da600acd33327d980b374479418420c5606ea13b425320f6712762ed3b809917e9", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245951, "uuid": "a17d5256-6df2-44c7-948d-adb9c49b60f1", "value": "T1B386BE52B39902E9D06AD5389A159633D2B2BC220772D3CF0795F6691F3BBD04FBA701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245951, "uuid": "0eacaf8e-536c-4c38-af41-54954df90987", "value": "196608:DGGNrWzn6Ag271HGUUPO3bpfnVfGJZaItX7AGhME8CdR:RrS6H2xmU/bFqZrtXEfE82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245951, "uuid": "f15d2062-1be9-4c79-8336-7b072b5c2b67", "value": 8017920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245951, "uuid": "f8d5c001-4c74-4ac3-97e9-280e7faedcfe", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245951, "uuid": "dc1f790b-a0ff-4bb8-a429-1c43910c97a1", "value": "9d7aebba3271d1d00dbebab0e608f329c0bfc40bbcc34922419a191728d05248.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc7efc3-8a4b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785219387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785219387, "uuid": "32b2e3e7-eef8-4e54-8007-e53b51d6e93d", "comment": "Malware payload", "value": "f6a04f4dca641f936402d9903560778c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785219387, "uuid": "f5bb95ac-4d57-47da-abb4-4c5048bbc086", "comment": "Malware payload", "value": "9df4da93250d13056c5ecaf13443675ad167dbc5234372986ffe0f7f840607dd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785219387, "uuid": "f6b0501a-809f-47a2-b282-dabaf353d036", "comment": "Malware payload", "value": "254fe209bac4bea7cb8e9a98523b7ad883f44bab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785219387, "uuid": "681fdc55-c597-4e5e-a85d-70cabe795452", "comment": "Malware payload", "value": "02c4f6a6f4f443ead96b54b3d51a82396a7b2b1fd848fdeb8d253cb5349e5c29fbb09d57e895ffd23b70d695e320cc18", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785219387, "uuid": "87c70bb7-d6b8-4598-b18a-b39019fc032d", "value": "T1F39549FA8275112C55BD6D26EF365B66E4B7D4B48F61A21E3A3F38849F804F80390E74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785219387, "uuid": "7e543db7-e645-4777-9e5b-a454537a32de", "value": "192:EONOaONOaONOaONOaONOaONOaONOaONOaONOaONOaONOaONOaONOaONOaONOaONJ:hKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785219387, "uuid": "cda62d82-4f95-448f-a4b8-0fe84cb4e46a", "value": 1985000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785219387, "uuid": "7c84ebe3-ae75-4b9c-bdd4-49f0ffcba477", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785219387, "uuid": "79ee8907-64dd-461c-aea0-0f7588572c50", "value": "REQUEST FOR QUOTATION (PCMSB P1TA19] RFP-000000186514- (PCM TA19 FH-SBH28-26274).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e58ebf6-8a75-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785237131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785237131, "uuid": "99ecfa1e-9f5f-4c02-9e94-64d6595d8712", "comment": "Malware payload (Formbook)", "value": "a11bc7fddad2602881739faab6875ad6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785237131, "uuid": "fef82ff1-11e2-4d8c-86cc-64b9b710a4a4", "comment": "Malware payload (Formbook)", "value": "9ed59215e24621404e058f8c0e9101e9351e147f5b367679b8d62ec73f44d169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785237131, "uuid": "fb8f78d5-6724-47f8-9b56-74e3461f42b1", "comment": "Malware payload (Formbook)", "value": "4f7d335ec58a31f3345b3d9458945872be2eb378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785237131, "uuid": "1d6431ac-8cde-42a0-81f9-360f974cefeb", "comment": "Malware payload (Formbook)", "value": "f7c215e2f1d7eef436f1a409baea667c8b6ca8bdf2a4d8110de1021318279dad8920d2a237ccbcd2205bf2cac4715b4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785237131, "uuid": "4cd83a3a-36e8-4af1-aef0-96a7b1cab1f7", "value": "T11425226122A5AB26E5BA2FF964F0D53853711CCDB531C24A8EDAFCDF7994B005810BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785237131, "uuid": "ed9af119-e792-47f0-8bff-fbc46de0a87c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785237131, "uuid": "f32e4f5d-fb1b-4142-8d23-98030b6c79d8", "value": "24576:SnUTulErpzkDGFrjx+T9RcRMPmBsDnDFosZ7l6:7TCmGDG9j0TzcoisD/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785237131, "uuid": "6566ed25-52f5-4eb0-a5b7-2c0d36c01d06", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785237131, "uuid": "df762cf5-9ffc-4224-82a3-94416ea9c93f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785237131, "uuid": "8dd1d7ec-da80-46bc-80c9-7f8cf5556285", "value": "DYyDQyvpujOEjl1 (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a80cc6-8a83-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785243128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785243128, "uuid": "c062f343-ac16-477d-b1b2-34d475467485", "comment": "Malware payload (Phorpiex)", "value": "6c0ff1c6abb8601339f818e03e4b3a14", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785243128, "uuid": "d2eb98c2-25e3-46b2-acdb-a5c689199483", "comment": "Malware payload (Phorpiex)", "value": "9f6d1bb57a8e1d6a35b192a38f21ba2f2c26ee299a7640c2b1d6f724d1c23862", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785243128, "uuid": "cc484cc4-ff00-4b4f-bccf-e9059cdb45f4", "comment": "Malware payload (Phorpiex)", "value": "c2d5d787f48ba8c6a672b716a4914910999ed354", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785243128, "uuid": "9a8a1aff-fc17-43a2-8318-4f7854690619", "comment": "Malware payload (Phorpiex)", "value": "1583a499c0f63f9ebf5d4f941eaa586aacb85c1191fb78c15a859062d332e03b37fac8310f6ad0dca77e784f5006dd2d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785243128, "uuid": "39610c08-d1a2-4c45-8c08-4b5c540d443d", "value": "T134623A0AB4818035EAE04075827F526645FE6DB623C0F9D7F7E0A8C949B4BD1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785243128, "uuid": "6e22db40-ee87-4b67-9231-cc4e659134b7", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785243128, "uuid": "bbe0b62e-cbdb-4743-a4ab-a10f9c3ae967", "value": "192:AW3sGnjXgjk8LcRI+Q1RDMRYfV/F5oIVUBKUSftzQFBrfgJxTmv8U9cthH9ik:A+ScCRfV/ro6toB0av8U9cdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785243128, "uuid": "d0f4ed72-5dfb-439e-9c3f-1f658a405953", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785243128, "uuid": "eee2a9e9-6cb4-4fe9-b85f-0621bb990234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785243128, "uuid": "de64484d-9ceb-43e9-8fe5-67c76d42ec4f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d073fd-8ac3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785270750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270750, "uuid": "7c5ebb4f-1154-4bf0-aa1f-726e7f48e643", "comment": "Malware payload", "value": "a5b72f88f042c0215aefcfc88f003343", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270750, "uuid": "2b0cec97-a0f9-463b-8390-2e0b7a76aeb4", "comment": "Malware payload", "value": "9fba3a68221cc6d7ca5a0f14881e0ce7e1c201009901e715e9f49aa2c5447da1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270750, "uuid": "8aecf448-56e0-4ef1-aa9f-38d317ffbe93", "comment": "Malware payload", "value": "5cc353e77e2c62a9ca916a5aed3faaceb360f24d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270750, "uuid": "8a761920-4cb4-42cb-a994-fe2cdcbc9190", "comment": "Malware payload", "value": "210c4eeacb3b61daf0a724d6ef2d7aaaba8d78dd8fd8de4c4377346bb28436a1b53042c9efaeb50cd429c54cb72dcc5c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270750, "uuid": "d338df47-e69e-401b-a469-93efe187f0cd", "value": "T110C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C12F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270750, "uuid": "ca2be80e-1be1-4cf2-8f25-066ed49fb882", "value": "768:eeY8vCB+25j6es8RD9FYpMSUpi+20qUpi+20YQX:o8l25JFd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785270750, "uuid": "01df25df-0762-4b30-ab01-35dd7a2fd012", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785270750, "uuid": "ac3864dc-09be-44a9-a515-7526904f7eb0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270750, "uuid": "28f60030-3169-48d4-b5ac-64de6d1efa37", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc832004-8a4e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220727, "uuid": "b449d6df-66a3-4ec9-bb2f-a0425696776a", "comment": "Malware payload", "value": "8406e222cfd9ecc1e2d9fbc717e6af3b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220727, "uuid": "9bfa2852-c500-4b2a-8796-4010b87ef13c", "comment": "Malware payload", "value": "a0408f508c544b385931dc7c4202293a54e71a26467101f2ed1e5f22506ea4af", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220727, "uuid": "7dea67e0-29ca-4dc1-8240-040ac8a0526d", "comment": "Malware payload", "value": "4151baba8c89f7d7eab0b549651b5893157205c6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220727, "uuid": "c20571d5-eaf6-4530-be7a-57015b11a9e3", "comment": "Malware payload", "value": "5253a6bf62fa57471317d76edaf5c8732272250bdcb3409cb8b9c2614bc18a3bc6cfc20e227660ddde631bf241e62e0b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220727, "uuid": "0f1c91b2-1a6f-46fe-a782-fa6e0501c01f", "value": "T179716DC4B2F74D0FCF8D79B829D8BA7E071908D53B2E354F5AC4088C8822257994FA11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220727, "uuid": "cf9b385a-cb92-4a1b-bc68-c5eddca047f4", "value": "96:5/MDVeq5+8WmsGfCznUGJWcQPoMYHcn4eQ1vhM/:5/eWmsGfCZxgoMACoM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220727, "uuid": "7c8303f3-255a-4120-a14e-33d9c57354db", "value": 3578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220727, "uuid": "e01b4030-6e0b-4125-81ef-7c864dc18366", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220727, "uuid": "25707f2c-fff4-4667-ade6-c32bce1f57de", "value": "images_20260727_232611.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99679c1-8aa2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorphiex)", "timestamp": 1785256773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785256773, "uuid": "ea42997b-eeb3-4d65-a825-31838919c4e9", "comment": "Malware payload (Phorphiex)", "value": "9dbe63ff5c9393de11670dbb2d40a957", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785256773, "uuid": "62722afb-e7f7-4489-926b-ff86daf153e8", "comment": "Malware payload (Phorphiex)", "value": "a10a9ed6f6c5d33349fe711cb5dcbb0556973505d5430fb08a81ac1a5ab135ea", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785256773, "uuid": "bee116d6-20dc-42d0-86e4-7cf88af60107", "comment": "Malware payload (Phorphiex)", "value": "a9dedd9ae560aba94a3fdf038f1f953f01724c42", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785256773, "uuid": "caa35ca3-1764-4cce-88df-a0e0d3f70738", "comment": "Malware payload (Phorphiex)", "value": "aafadaa8ca9a288fa780f42dac419fa8a35876de4b5b87eafd254047924efe188fa93c3a741b8e5114438d6a10e60444", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785256773, "uuid": "db3bb789-2d8e-4508-8e24-366203d9eb25", "value": "T127623C0BB8808036EBE04475827F526649FEACB623D4F8D7FBA068C959B46D1F43516F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785256773, "uuid": "c5a7eb0b-3b7c-4415-b4c6-454c3c443baa", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785256773, "uuid": "7f6aac2e-ca1b-441b-a5fd-84e8ad2424c1", "value": "192:AWysGnjXgjk8LcRI+AxOsM9ofpF5oIV5ixBKUSf0zQA8FuixgJxTmv8U9cth+W9X:AbScxufproKn0t8Etav8U9c+IX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785256773, "uuid": "0fe0508c-9b84-4faf-a596-d853a7432a70", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785256773, "uuid": "d01560c9-0e54-467a-9c8f-6556d827613c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785256773, "uuid": "75f24a0e-061e-4325-a7dd-33e5d83f55b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf075f0-8a91-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785249366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249366, "uuid": "f69ff7e3-9d2a-486d-95f5-ece39a64797a", "comment": "Malware payload (XWorm)", "value": "7a14b68f8bdc5e562e38ca6fdbdedc64", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249366, "uuid": "8ea31133-9b68-4991-ba93-bd86da54bd9d", "comment": "Malware payload (XWorm)", "value": "a128970a6df8b4be74fcd09a2a957b66b59f52618a2aedf2179b772df120c55f", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249366, "uuid": "daee311b-3936-4950-baae-7cf02ce3bd3e", "comment": "Malware payload (XWorm)", "value": "619cc8c453c97b104f54027ced830014e60e1835", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249366, "uuid": "5ee4f870-8388-4772-a0aa-7fca1cb94fa5", "comment": "Malware payload (XWorm)", "value": "1c74574099ee09c1338ab56d4f75918de7bb6d57cd36f299387c3501436dac63cc889c07de31e1853f57272ce597cd6a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249366, "uuid": "bcf71ffb-fe9a-468c-86ca-ff5e8ccaad16", "value": "T1B0514A369FA4654EF88601B42D8D51FE618FA6BF4E4EDC50F57AF32F5492B29E112800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249366, "uuid": "64f3c6d2-bd9f-4ab6-8dfd-1598ecdb0952", "value": "48:j2pUTRDowC+uDGIYVivaewq79TSH8WSien6zmgXig1X2xRO15O0+wewJOjQnoHbO:ju4aGrivHpBWSi26KgXig1Xe0DORekK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249366, "uuid": "3d707603-7e65-4e66-9587-2549bab9a66e", "value": 2966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249366, "uuid": "20cf0f47-5f23-4d6c-b125-11b5f10094c9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249366, "uuid": "1cfe4e95-8ffe-481e-84c4-08dd018607ef", "value": "Slip-01.lzh.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d44fb3-8ac1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785269995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269995, "uuid": "82226526-1a99-4727-8acb-b794f9f1a285", "comment": "Malware payload", "value": "1fbe2ded02e88e4d9318c068437e4358", "object_relation": "md5", "Tag": [ { "name": "103-193-173-83", "colour": "#A458EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269995, "uuid": "0043eaa3-028e-44c0-a56d-2fcca05ff6e0", "comment": "Malware payload", "value": "a1a91d9cd396186c4fde28e050f88aa68062b05195aaea091e7b3a1ca7539893", "object_relation": "sha256", "Tag": [ { "name": "103-193-173-83", "colour": "#A458EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269995, "uuid": "6b57e85b-254c-43b0-9c83-e245753ed0b4", "comment": "Malware payload", "value": "b936c514f6fbb82ecddbf281f52ebfee2f0c4f6d", "object_relation": "sha1", "Tag": [ { "name": "103-193-173-83", "colour": "#A458EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269995, "uuid": "34b10bb3-d290-49eb-91bb-6ae2994c90d5", "comment": "Malware payload", "value": "572032947abbcbfd8a7490a770988c8cdc1bd4b7fec72359182627f814482ccee5483c4db570d0c51f2b75e8c87e463a", "object_relation": "sha3-384", "Tag": [ { "name": "103-193-173-83", "colour": "#A458EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785269995, "uuid": "921cde14-37cd-4396-9e9c-4ad9d0924155", "value": "T1D0565B17F26611EDC07EC174834AA232FA71784947357AEF4AD09B212F62FE05B7A709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785269995, "uuid": "42789f03-c1d6-470f-8483-6ff69201e896", "value": "f2646023aecc478287007e824cca1e49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785269995, "uuid": "8c54d9e8-e0ad-44d3-87c0-5d2cb3b790a1", "value": "98304:0kerL0AbCfxzGkVsF09zk7ZWAvXk/Fw/qBmT+LLNFgZ:sL0AbXfvUqyNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785269995, "uuid": "f1b2cb7d-16bf-468f-b4f8-36e5c857c2d9", "value": 5928448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785269995, "uuid": "4d38cb8d-935b-4a17-bf62-31df0f9e1d0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785269995, "uuid": "3396078a-1997-458d-b1cf-3b710c340c2a", "value": "dropper-msvc-x64-no-bait-noselfdel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a79fa8-8a51-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785221813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221813, "uuid": "3df80db1-0a02-4705-ab54-82609a32095d", "comment": "Malware payload (Mirai)", "value": "561611e73f5c545307bb6607ac8a6383", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221813, "uuid": "1ef8f9f7-7733-4403-901c-e7b5c4643f02", "comment": "Malware payload (Mirai)", "value": "a26c1d2aa68196b6c5d36257c2b4c6c515df43ab78a750da936038299bbe4956", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221813, "uuid": "09533a93-d098-4fbe-b05d-f0eb3778b95f", "comment": "Malware payload (Mirai)", "value": "f2b20fb3d4591d4e718b537bbddf8abd381314a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221813, "uuid": "f3024f95-a0fe-4bf2-a35c-65eca6c85ef3", "comment": "Malware payload (Mirai)", "value": "f607962f206ae223c6a68954efdd809d3988a57f4990cce0957559aa7ba8d9968fba062c5c6818f7e0a34c4160e186f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221813, "uuid": "a8e8162f-29f2-4b2e-843c-2a4aded7ccee", "value": "T1FA632A56B8419F16C2C12677FF1EC389372763E8E3EA7203DA152F6933CB41A0E2A555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221813, "uuid": "c3e71e32-81f8-4fd5-9abf-51921ee255fc", "value": "1536:2225xQjTvX6Zc6QYqdKkhrUBN/JfWYgYCeZcicvF7EoXNN33yLfhia5a:2225KjTqUUkhUBhJOYOgBMF7EANJ3yL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221813, "uuid": "24f5ea13-b0d7-43f0-baa5-664f008cb45c", "value": 68060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221813, "uuid": "d5ee24c5-9628-43be-88d6-f8ce6a7a1c15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221813, "uuid": "6c677d81-447f-4da1-8732-c0144842a059", "value": "c2lv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9df99de-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221045, "uuid": "29db2c27-553b-4f64-abd2-7bab65b06f84", "comment": "Malware payload", "value": "1062d49c8a9a7a46db494145c74b8f5b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221045, "uuid": "5e223b17-7b07-4aaa-a061-9d3cc2ceb0ad", "comment": "Malware payload", "value": "a2d5e999e4b863a441f8b414cddfdb929d4b22206978977d00d87a32a3e5b7ff", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221045, "uuid": "de8cc720-f26e-4d5e-893e-71efdeca00b3", "comment": "Malware payload", "value": "4aef076396f574233dfed7eeeea4697def676450", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221045, "uuid": "c0a5e4f3-e5cc-4fb6-a52f-9a232a1a8058", "comment": "Malware payload", "value": "f85f5754dc81b134c7e58f31c61d9dedafab423ceaef694c6e3548c857955f95bb2a2f11cbdb42c341ec32ef6776e7ff", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221045, "uuid": "49264072-24e9-4034-b99a-9f1d12a2a07a", "value": "T1E5614CA90E925F32FBD4ADB819F6F5F02755A180576131122BBC87B1019EB10A1456D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221045, "uuid": "ec82248a-4f7f-4b57-b357-ffcd887a6d58", "value": "96:bCQQXKUH815NuflZ5hB/84XZbtVUFKonCFR:GQZUH+5N0ZJ/jtVWKoCFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221045, "uuid": "7956037f-4763-4a9e-8ebf-6edc636f2ea4", "value": 3366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221045, "uuid": "2577f28f-349a-41a0-b931-0eb6152e822e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221045, "uuid": "9aa2c0ad-72e5-46b1-ab0a-f62ff63227d7", "value": "images_20260727_233744.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e64b8d1-8a1a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785198128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198128, "uuid": "6657b764-70ed-46f2-ba7b-13b0e062c5a6", "comment": "Malware payload", "value": "691012e5920fd8cc43c6ba437429916a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198128, "uuid": "15de46a5-07d2-4a40-b493-a8d2a30c62b8", "comment": "Malware payload", "value": "a326333799d5c425a31de391c84c839de3a25b39bf9c4ba3bed95aac8ea0043f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198128, "uuid": "37103866-b72c-4b75-a3d3-526a8546916b", "comment": "Malware payload", "value": "69bc4cab0a1d08e103f2a003ce101b3eb8d9cdd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198128, "uuid": "1caea6cd-22d4-4a57-90fd-95c5b75c5f7b", "comment": "Malware payload", "value": "e775ce835c2412ac6129458d75b7541b0892b0dd711f5c4f57741c21cfbfdc52330130f436c1dfb894926e4132a89446", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198128, "uuid": "c71c4024-9196-4946-8ee6-1ecb60e8adbb", "value": "T17C22421BEA82C6AAC0D563F428C7457037B1D490E7315367935CED355C63B884B2EE5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198128, "uuid": "90220c7f-3f96-4d6a-9670-c9893cc868a3", "value": "96:Rb0BWBShzO7ce5wXs/e/Aah/Na7LSl3qwMCsHwzqHiKTgQl8KuE3:Rb08chzOHksmROL5HgUiqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785198128, "uuid": "b1e02b44-5204-4bab-b35a-c68dcf2a3aca", "value": 10208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785198128, "uuid": "d580dc5f-7d3c-411d-9145-f642a3148222", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198128, "uuid": "17077c28-b53b-4b00-b946-676591020361", "value": "libcommon.so_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd60fde8-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785245961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245961, "uuid": "ef17c35e-29a1-4893-8ff7-fd9cf294d39b", "comment": "Malware payload (PureLogsStealer)", "value": "21436f2d055ce5ac0fcfa5a8beb74a1b", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245961, "uuid": "0cda26bd-10e0-401c-baae-a7209c088520", "comment": "Malware payload (PureLogsStealer)", "value": "a392ab291af76e8ff631a4e38b75b346989088ee823a2ce3d4c2dbbf84b6d500", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245961, "uuid": "1af7ce05-bff3-47e5-bdb5-ae97dbf199aa", "comment": "Malware payload (PureLogsStealer)", "value": "2a51143859be908b8860e1b65b5dbad4ce5262e6", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245961, "uuid": "b63333ca-46b3-4629-a541-25595e6c0bc4", "comment": "Malware payload (PureLogsStealer)", "value": "09d2c65ff32082cd792184771cb475cdd9100351817e8aa87524a30329544bcb92f82e36b5baa0b611aa427aa4781cb3", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245961, "uuid": "56638e82-fdb2-4899-a1f9-24575f70b3da", "value": "T1E026AE45F7D80BD4E46FD630C96B8731D6B2BC960F62838F1558CB062E739A19F6B212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245961, "uuid": "bf5b5ee4-4a63-4546-aafe-482bbd86b88f", "value": "49152:H4AnDOnL3VSpJC/iu0cehTvgFKLGdswaJdgEUsbT/ukPjKNwCAhH5dcXOESp9r6:HMw2swaJGvs/mkbKiCA95dazSfr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245961, "uuid": "09733a95-387c-4e97-8a67-98cd39d2d2a1", "value": 4577280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245961, "uuid": "398bd382-6917-4270-8b63-85499a764138", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245961, "uuid": "ad58aa87-9923-4cfc-b7b2-2de478fa0ca6", "value": "a392ab291af76e8ff631a4e38b75b346989088ee823a2ce3d4c2dbbf84b6d500.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341a1bb9-8aa7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785258616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785258616, "uuid": "b6a9c8c4-e762-4615-ac13-43269936077e", "comment": "Malware payload (Formbook)", "value": "8d1bcf322230e8935758228cebec1bb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785258616, "uuid": "de110ee1-f265-42c5-91e8-0e26e25ddfd5", "comment": "Malware payload (Formbook)", "value": "a3ab968ecfe40961e381aff0e5bba919eb4e8cfcbbf445cf44441197aefbb399", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785258616, "uuid": "9dd620e4-b7eb-42a5-b4c5-e3762cbe1e36", "comment": "Malware payload (Formbook)", "value": "692da806793608d10cbcbdf06e440f66094a291b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785258616, "uuid": "9906be62-fafb-4443-9ce3-0e48c6a07280", "comment": "Malware payload (Formbook)", "value": "ba7c39dc320030d6082b4c2b0e48183f67484d18397fa926d07e5937e002da6087b10798a674276425cb2eec3abbeac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785258616, "uuid": "fc27a417-01d6-441a-b1b5-3e9e8754c922", "value": "T1A225235D6655E726D47A1FF90461F93103B66C9E85B0C308AEEAADCFFAA7B042D00353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785258616, "uuid": "28d910ea-15d4-46b8-abc2-c77fdab98e58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785258616, "uuid": "a303b8bb-e873-4986-b61b-6f3138dcadd2", "value": "24576:GWE7+1r2eGstK6jpH/TneRb5HWIG7g+yF:GWE7+BVGGtH/SR9FG7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785258616, "uuid": "f982cf3f-5cf4-491f-9a48-d89f93e3ab87", "value": 1008128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785258616, "uuid": "ffa19e73-ca93-49db-9d2a-bfd97588aae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785258616, "uuid": "325f50a3-5e06-49b1-8f71-bc0aadfedc42", "value": "PO10025_2026_07_28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34dd06d-8a27-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785203907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785203907, "uuid": "60e08368-456d-43ae-86f3-821482eb3a4d", "comment": "Malware payload (Phorpiex)", "value": "c7e6b3208a4bf04ef28fd3b37008b7d2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785203907, "uuid": "ba8ed9ed-314a-44c3-872f-8a8affc98cfe", "comment": "Malware payload (Phorpiex)", "value": "a522e892f5a5d41e6b71dfa435491682dd20fe2f562075af071f929c3fa38620", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785203907, "uuid": "8d07c117-9b3a-4880-b7b7-5b941adc05cb", "comment": "Malware payload (Phorpiex)", "value": "701fc165b905a9cb704c689ee8fcc46dae33a660", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785203907, "uuid": "9815b44c-c0e2-45a3-b56c-1320ac67fe2e", "comment": "Malware payload (Phorpiex)", "value": "3d97790e698b3075f1329ffa02495a7bd9a3751ff3e516b877172ff933cbd0bc3eabf3a686707440a5ff56477cd56089", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785203907, "uuid": "47c03948-5501-46e4-96d5-9aa1e5005a38", "value": "T19A623A0AA4818035EAE14075827F526649BEADB623C4F9D7F7E0A8C94DB4BD1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785203907, "uuid": "3b465183-82f7-4548-ab9e-f6786da675bf", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785203907, "uuid": "d3084ab5-24fc-4637-915a-857b9db5204a", "value": "192:AWOsGnjXgjk8LcRI+Q1RDMlYfV/F5oIVUBKUSftzQFBrfgJxTmv8U9cthf9ik:AXScCtfV/ro6toB0av8U9clX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785203907, "uuid": "837b17df-dabe-48f5-af75-4beb20f95643", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785203907, "uuid": "06f50474-c997-4d58-9f3e-128bb96d0455", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785203907, "uuid": "61ac71e2-1b4f-4ed8-80d6-269ccdb53e36", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f01502-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1785224440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224440, "uuid": "d6ad6d3c-d315-4771-a42e-3f473e4cd7ce", "comment": "Malware payload (DDoSAgent)", "value": "c4e4afb20113bcdae10d5740338420ad", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224440, "uuid": "41d7de7f-c5c6-4277-971a-28854f2f51ed", "comment": "Malware payload (DDoSAgent)", "value": "a5b1739ecc786cf695336172a133f236aafbc2270f63bd439dd8098259644fae", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224440, "uuid": "73355e6b-569f-4a65-a8e6-9010ee69fccd", "comment": "Malware payload (DDoSAgent)", "value": "a46bc1650cc3815e31996751b8cf47a20ed19262", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224440, "uuid": "5c793d7a-8fe5-48f5-826d-2514f17fb589", "comment": "Malware payload (DDoSAgent)", "value": "314754a8f30e2bf2039311b32ee6a49c84e74b934bfccfd2f20b0316f5f9c1423c3efb94068146758553feca7036d304", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224440, "uuid": "4c125b6d-2e79-489a-ac50-e7973fdebcd7", "value": "T143360A11AEC26B66C1CC03B844EE665A72603E454BA5472363E4F7FC3A7773C9F5A848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224440, "uuid": "19895d14-7468-44f0-b222-adab603e2080", "value": "49152:9SYYXSg1FBLO5bscsLrr4boapGiRr1xHbX62Pf5E/:9/CnBLO5bsEuILlE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224440, "uuid": "f5fec4f6-fd79-43fc-9d14-ef9baf885cd2", "value": 5177492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224440, "uuid": "3dfac1a8-6278-410a-9ac4-68e32c9f1c89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224440, "uuid": "231752a5-5522-429f-9553-d759569d69e7", "value": "scsi_tmf_0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022a842f-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233192, "uuid": "9a47652f-6198-42dd-ab35-468f6944362f", "comment": "Malware payload", "value": "7274d04756599e2dfeff0d75cb84508f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233192, "uuid": "639adefc-6043-48ac-954a-34977d28222d", "comment": "Malware payload", "value": "a5e1959965737b3981bc711e6041c823234508bca9415b2638f547f2f704e6e7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233192, "uuid": "a7f6a864-5517-4c59-b99c-5773d3cad87b", "comment": "Malware payload", "value": "5b7004b70ae61599bb7886460cc2d20378b217f7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233192, "uuid": "72cd27bd-25ff-442c-855f-913889470aee", "comment": "Malware payload", "value": "e06551b7c92c483c024680537228e2ab1c8b33d1058f2ccda4af3d62d6551697c511f69b2f7fbc2c27620a49703c685a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233192, "uuid": "fc0d5fff-fcb3-4c2d-b80c-8a90b53802c2", "value": "T12152B054C36E5D5FFC7009E99322F6B0FA1B781662407DC2958083D9AD2921DE4B4A5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233192, "uuid": "e44b91f7-2148-4b1b-aeca-e57049dc3844", "value": "384:j1nTGXagt0Y0aJVtIb+1F6nGvMYhPswL1Gb:j1nngtd0aJi+DTEYWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233192, "uuid": "de09fda9-dbd5-42be-989b-84a1cf5fe325", "value": 13904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233192, "uuid": "f87d3aa1-a191-4afd-834d-b82d018f09a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233192, "uuid": "a888e889-01fe-4f4b-9307-7f88c89d841f", "value": "images_20260727_133747.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3576c30-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785245971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245971, "uuid": "f27b3438-4b47-4606-8e9b-a552b346ea90", "comment": "Malware payload (PureLogsStealer)", "value": "8eb12c92220fd643d0d63347b5bacf74", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245971, "uuid": "b626daf8-b8b7-4db3-9925-59124270e745", "comment": "Malware payload (PureLogsStealer)", "value": "a66a0a22f5e61f4098c595260074f0ebc1bbc8d507241fcedccd2806864cd55f", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245971, "uuid": "83b16559-8c46-42f2-abc3-da52404e294e", "comment": "Malware payload (PureLogsStealer)", "value": "7a8d5a276456b5a6d8b396e14a84e9250855385c", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245971, "uuid": "ebed9aa7-85fd-4efe-9e50-99fcdd83fce8", "comment": "Malware payload (PureLogsStealer)", "value": "0114c8b735b36bc722722b63a4d8dea828a8af9877c5d655f47a5e1d01dc5bce307c6d5d1d97ce84b47f7e33c7da3282", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245971, "uuid": "7fd6b671-ed5a-4b0f-a17c-355198071765", "value": "T1FDF5DF14A3E801A4D977E638CA959333D6B078969330E58F1A9CD3052F77EA19F3B712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245971, "uuid": "82192a6e-6903-4cae-83b9-b493302ae43c", "value": "49152:z40raN2iCOlmxkH1VHU7B460m2tM/6a4ddWCBvq1s7gsx:U0ioibr7a4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245971, "uuid": "06c74f6f-c3c2-451f-ba2d-b178c44250da", "value": 3452928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245971, "uuid": "63cb40a3-9d20-48a4-b57f-f17b44f0c81d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245971, "uuid": "4f8f2bc1-c449-480c-a60d-e83c45a946bb", "value": "a66a0a22f5e61f4098c595260074f0ebc1bbc8d507241fcedccd2806864cd55f.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733da04b-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785211048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211048, "uuid": "abda78a7-b8be-407f-bb5e-8315fad38a9d", "comment": "Malware payload (Mirai)", "value": "d30d678cf7a3baad5e341205bbbf6ac6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211048, "uuid": "8def2ab5-1d17-430e-8a27-739587cabe41", "comment": "Malware payload (Mirai)", "value": "a710f4687dfd5647b5e54106a29a0e4a606498ffad07d6913bf115697c33ddd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211048, "uuid": "d754bab9-15c3-4615-a985-78f720cff245", "comment": "Malware payload (Mirai)", "value": "dfa115390745585eb7e33f4fe177a1360a093a4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211048, "uuid": "4bca8638-ce9a-41e6-82f5-8aca07db6d37", "comment": "Malware payload (Mirai)", "value": "578eded53580767bd19c2598a08262d82b822d65130775c692ab7e65af21f7c52beaeedaaf5b51a5f6da95161bd05998", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211048, "uuid": "78b00eeb-e7a1-4b18-89cc-727608c417e1", "value": "T143D58C57BC9145A9C0EA963289A292927B21FC491F3123D73F90B37C2F72BD46E79314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211048, "uuid": "26b63aa2-99a8-4412-b934-cedf3fad8c1a", "value": "49152:J+9QBQKxHJVBteRdDp/YDay+IjdSWFWZ2cRAY3NQWDEQ:TbFQ4DMI8WMRnNNAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211048, "uuid": "83d66293-1629-47b9-8247-591862f1dd07", "value": 2974762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211048, "uuid": "a49dd396-c6d6-4624-b6bd-987fa8fad3f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211048, "uuid": "4d7160a8-8163-48f7-ae4a-44a47c17d567", "value": "listen_v3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b341f2d7-8a8f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785248521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785248521, "uuid": "8c536278-c849-4a90-870b-188ec5a88f39", "comment": "Malware payload", "value": "d61b10e126e202cc1723c28016898b98", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785248521, "uuid": "02805668-0161-4ba2-8e36-3e4bf7f877af", "comment": "Malware payload", "value": "a89c4e4576d8f180a915ddc1d1233aa1b0fb0853eddafad84c3b8c2af85849ff", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785248521, "uuid": "58fa97eb-728b-4bdc-80ae-714a8185e762", "comment": "Malware payload", "value": "cfd68bb146fc2a054cd7733b0eee665c3f91f62b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785248521, "uuid": "9978dbf6-6e73-49d7-a607-13e0e7261452", "comment": "Malware payload", "value": "21e33e4413f4544e80d38a8d5003f0d01618b36e1bf6737491c25f10670e373636ff36e2be1fcabaa6d644c549494abb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785248521, "uuid": "28826646-3f7b-4502-84a2-e2b11ebe4bf0", "value": "T1852733A62C262E83CA5526BB23531742AF310CB33B1187116D79F92D1CBD1FA4B5D39B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785248521, "uuid": "120b7f19-b62a-40be-99e7-c98d6efaac75", "value": "393216:2/ceNLS3gl9Qv87upe4GCAKUdOCu3et1bGHaDsxiY:2Dpq06tA7dhIeYEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785248521, "uuid": "d8b4fe0f-53eb-469a-9fb2-5b5cf912c070", "value": 20369408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785248521, "uuid": "c8dc99b3-8fb0-4ea7-b3e3-3f71a0349743", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785248521, "uuid": "474cc000-6d6b-4615-baab-c01259525693", "value": "activator.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fb5c83-8ac8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785272975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272975, "uuid": "58506fab-460a-4f8b-bd8e-d28b913bf6b9", "comment": "Malware payload", "value": "cb0c82265258d1996b059f941b9d529a", "object_relation": "md5", "Tag": [ { "name": "AshenLoader", "colour": "#9455C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272975, "uuid": "7127bdda-3167-45fe-a026-e4b12d20027d", "comment": "Malware payload", "value": "a8d04c3d4a97c48d33d9e14009bb3765f22242d51d9a6c9cabdaaa0bb7b22270", "object_relation": "sha256", "Tag": [ { "name": "AshenLoader", "colour": "#9455C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272975, "uuid": "9aadbc10-823e-4527-b052-e7918403aa41", "comment": "Malware payload", "value": "9cc4a2bc84540b8218167b250c2422ec07b22624", "object_relation": "sha1", "Tag": [ { "name": "AshenLoader", "colour": "#9455C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272975, "uuid": "0cbbc9a6-6df6-457f-86f9-555fb5077173", "comment": "Malware payload", "value": "45e50b7feee9f92d8028af5525aa52c56ae698d7faccfa2452bf09a58e9deeea1db6374841a2e119d8fee1d5fdcbfc6e", "object_relation": "sha3-384", "Tag": [ { "name": "AshenLoader", "colour": "#9455C2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785272975, "uuid": "6426e17d-f2b6-4c81-bd34-22eb4f17e7ba", "value": "T18FD2E16D6C035C0C89517436F69C6D8694A1FCD829791358FEE8B0835EE70BDB18277E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785272975, "uuid": "16364af6-2f54-4d3f-8ea4-75c70d7b34f1", "value": "768:/CTUty+CFmYiyzFy0ZR3XQ6UyO9iqGMXHgNDWYPCHJ0jL:wUs7tiMy0LQ6U/kjMXUgJoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785272975, "uuid": "7a7b49c7-9223-41c5-86c7-a5ba9fb60883", "value": 29777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785272975, "uuid": "c4c81a92-d676-4ec7-9b5a-5c48bacc549f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785272975, "uuid": "b5fb6a6d-509b-4fd9-8c4d-91bfc3d9248f", "value": "CGP_\u0417\u0430\u043f\u043e\u043b\u043d\u0435\u043d\u043d\u044b\u0439_\u043e\u043f\u0440\u043e\u0441\u043d\u044b\u0439_\u043b\u0438\u0441\u0442_\u043f\u043e_\u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044e_CommuniGate_Pro_\u0414\u0435\u043b\u043e\u0432\u044b\u0435_\u041b\u0438\u043d\u0438\u0438_2026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "585c9cb8-8a71-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785235484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785235484, "uuid": "293c69c6-87e7-4bf4-9d46-4c235c317803", "comment": "Malware payload (Mirai)", "value": "9ef078a3df9c308fce1a5fc913b6920e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785235484, "uuid": "9ff1103e-817b-4c63-b7fb-767d755891f2", "comment": "Malware payload (Mirai)", "value": "a9466850ea7c96d3e4ae275e81c304fe431a1e0c104c62c91e81cd3fb268003a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785235484, "uuid": "2e3c8e2f-3877-4644-9989-405baf8fa6d8", "comment": "Malware payload (Mirai)", "value": "0579ea964c52bb0717f7c2e721bdc58e7dde8baf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785235484, "uuid": "b23c23a7-3e18-4807-b265-8d362c249d5e", "comment": "Malware payload (Mirai)", "value": "1fa7d273e9591f09be498dfda06866afb94009704addc2ccebe10a9404f6861e25c4963b5e03043dc777bd468d6a1be6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785235484, "uuid": "c0f6e375-9fdc-4cdc-98fe-5be0490177a9", "value": "T184016BDA9260A910402DD99E36EB5690F431C3CB069A0BA47FAC583DAB8CE04B037F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785235484, "uuid": "2a12def6-3a0a-4855-a806-dd2f5777ffce", "value": "24:kXCKysE2hi0ziQvZohazLZ8onv+FxMXW847oSK07:e9Qp+MszLyov+FCG847nK07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785235484, "uuid": "45af58e0-d41a-407e-a6ed-795409d23fab", "value": 831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785235484, "uuid": "b94df88c-0031-4ad4-b3ad-4774078d255d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785235484, "uuid": "d9a06a3e-d3de-4137-9a9c-f7165f33c900", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d638139-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1785224433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224433, "uuid": "9f304a51-81c9-436b-b236-94be24303136", "comment": "Malware payload (DDoSAgent)", "value": "0d714f361df6efb54cd722a926aa54b2", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224433, "uuid": "5035fe64-d104-4d50-ab68-f790e82dae55", "comment": "Malware payload (DDoSAgent)", "value": "a963a61911c754a5f17f123bddfafd7a4d4ce2291051bc86e9fd60fe3af10d88", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224433, "uuid": "63cc0d53-abe7-4c56-8b06-a1341d75688c", "comment": "Malware payload (DDoSAgent)", "value": "91600bb36237672487d87867e5c90c5c957f8c56", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224433, "uuid": "612eab2a-6dea-49c4-bde8-56f7f8c8e98e", "comment": "Malware payload (DDoSAgent)", "value": "78e3cca4b0702d5a1142922aabfa2a343a75cecacb3a2b461cc142d1583a609df7cba813654f023d181feea06b015f44", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224433, "uuid": "db9c78bd-c40b-48bd-957b-47738b52743a", "value": "T14E260857B9D25942C4E83637B8BE81C433635EBA9B8B52576D05EE3C3ABE1D90E34304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224433, "uuid": "55665d75-c67c-4427-9e35-60364494a722", "value": "24576:OCFzo/RIr7C8hLuzbULxCLfhw75cOIiunyoYlomlv35Nwr5gPQAWkpjheYjuvUx3:P7QJUwkQZ++Qhzt2kzjHq2+mLT5Ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224433, "uuid": "2a5798fe-d8e5-44d3-a006-bc5ed83c9dfb", "value": 4784276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224433, "uuid": "d27ab78d-74c7-4545-af16-646520ac66dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224433, "uuid": "65fcc17e-c386-49c5-9b55-f0edcc593a73", "value": "jbd2_sda1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f07bef8-8a45-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785216651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216651, "uuid": "46cda62e-1c45-40df-b880-353d412bae0d", "comment": "Malware payload", "value": "576bfba568e0de0acda9fb03bfb0fa5c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216651, "uuid": "5db1ca41-b77b-406c-879b-ae5443f284a9", "comment": "Malware payload", "value": "aa365545c23947e3585256771585cadba95d4f7dc1437fac2cb519d57cb9cada", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216651, "uuid": "24a7e509-d53c-4fe2-be15-9ad0ebc81b2e", "comment": "Malware payload", "value": "c22e81590b910b0b479f7dfee11cc9ec1c691414", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216651, "uuid": "2363100d-4695-441b-ac0b-e66fffe8728f", "comment": "Malware payload", "value": "bbaf18365acef157dd16dae835b66330251db416d6b6d338a7eef159a7ead5436d4996c089eccb8556480d570ea44c07", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216651, "uuid": "faa29eff-b49e-41b9-9b7a-c5241a8d1f7c", "value": "T16E077D43E87506E9C0ADA276C6679663BA743C844F3163C36BA0BB381F727D0AE75741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216651, "uuid": "d8055f70-d0c4-4abe-84ff-5b4635e04e98", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216651, "uuid": "1b750215-c258-4a79-a567-8c5bda9697ab", "value": "196608:/yz3GhtuzK9YgIEvZJ3rvw/XC/0HeTVzPWa:/G3Ghtue9HvZJk/yM+BzP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785216651, "uuid": "13b3e2bf-a7cb-4c6d-9831-49bbcd536e72", "value": 16850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785216651, "uuid": "8408a3b8-4a0e-4b03-b215-48a9d9207e60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216651, "uuid": "2086c8fb-051e-4bde-ba3e-4ce50fae9eec", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2f959a-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785220805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220805, "uuid": "0f73e390-f9e1-4ffd-9293-b8d0e637823e", "comment": "Malware payload (PureLogsStealer)", "value": "c7ffd01310d80e2983ec4027232b5b63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220805, "uuid": "fad9d6a2-8f31-4091-8bff-33ed7f50fa32", "comment": "Malware payload (PureLogsStealer)", "value": "aa4948508c0c98758400c5b167319a5fc45fa2bdec45c352db96719e3b075362", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220805, "uuid": "f5000775-d4ac-486a-8f64-b7483de6a91e", "comment": "Malware payload (PureLogsStealer)", "value": "61892efc7de79c7871b88076dc0a7441a2cc058f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220805, "uuid": "9cb225c2-0efe-4e10-bcff-beefcbff0b32", "comment": "Malware payload (PureLogsStealer)", "value": "bec14c6628cfab8f8c8d103cf94a69d65c86de97323b82b8f752ff8de8101851740e95b3f48655a9bfe02130898237cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220805, "uuid": "a385c96c-fed1-4cc0-815c-7a06edebcf4a", "value": "T15405BF7A36998E25C14A5333D1C7890083E69A8737E7FB0B358903D619063FEDA4A7D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220805, "uuid": "531e1405-e810-41d0-9017-18827b410d83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220805, "uuid": "62c76b91-ab39-4ec9-a7b1-2c9bae8fa32f", "value": "12288:cdZ2p2SkpWC+ZGmiU0bPO4C1C6ITrZZlwf6gUZaDN0H6:cd8SeYmizPgC6ICf6gU0DM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220805, "uuid": "e84f51e3-5c83-44c9-9d4b-cb18a2a506a3", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220805, "uuid": "4db8ee50-e757-4f46-ab99-04274b27b553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220805, "uuid": "3660e9ae-abe0-411b-abb3-c8e6e85cf891", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.46254663", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a013797-8a46-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785216938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216938, "uuid": "1144d4d2-2cdd-40ab-9ead-aa0e63717237", "comment": "Malware payload (ConnectWise)", "value": "fcacc7ea0897dce4fd6aa38979978db7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216938, "uuid": "f8418b94-d1f2-4e3c-89ae-488766e1c21a", "comment": "Malware payload (ConnectWise)", "value": "aa5f4e85e97d1507df8a70018a9f1429360039b337b096b56fd695a532b926ba", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216938, "uuid": "316dc695-cb98-4f8f-89e4-3983547cbb46", "comment": "Malware payload (ConnectWise)", "value": "fb7a6169191984f3fe6b35756404b720f9168a42", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785216938, "uuid": "4d4e25b0-13b6-4b3e-a7ec-950919a0f8b1", "comment": "Malware payload (ConnectWise)", "value": "58df61c762bf901c43fdaa948ecf79fe21c71984aa0d2346ef42104b484a1a54c6a8dab07b9d54764cfad2093ecacbb4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216938, "uuid": "8fdcd9a8-a645-426b-8e1b-cffcef2bc94e", "value": "T1D446E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216938, "uuid": "a92241db-7cd3-4448-abc6-9e3cf2b5cbbb", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216938, "uuid": "1dac270b-f2b6-48b4-8350-172e322ac7c8", "value": "98304:OzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:OhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785216938, "uuid": "facddb35-f7c4-4558-9301-2bf18789d828", "value": 5642736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785216938, "uuid": "1585ceab-5cfc-46ca-9805-d5972f0422d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785216938, "uuid": "a489ae47-797f-4cf7-96f1-c148cf7c519c", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75dce2e0-8ab7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785265598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785265598, "uuid": "f8ae7bea-4db6-49bb-9ff0-f5398bfb850a", "comment": "Malware payload (Mirai)", "value": "55f97dd27d007bc1af1ffca99dc2c6f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785265598, "uuid": "65cb3229-4f95-46e5-addd-6cea7db1412f", "comment": "Malware payload (Mirai)", "value": "aa64bf1471d43b21cc0b6f761473ed2903439364e5495656b67fb9e747910bb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785265598, "uuid": "0da85cc6-8a1a-4e7f-aed4-717a92b5deb6", "comment": "Malware payload (Mirai)", "value": "c26ede663049aae3c012376527850958f227cba0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785265598, "uuid": "ad366ba7-4015-40cd-bca0-3d0ac30abca1", "comment": "Malware payload (Mirai)", "value": "fa31af94eb63de580e3edb5d16bf5e65e4775e115a0835471705875b42f26ba7bf1d4e9a8ed5d06ef2decba46429717c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785265598, "uuid": "960f698f-4eab-4033-a861-8d03bcd46ce7", "value": "T14CF3985A2E228FADF678873047F74A34976923DA23E1D684E1ACC1141F6435E641FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785265598, "uuid": "f72cfd8b-623b-455b-b524-923af8816b0a", "value": "3072:F1RCBE/uJ/n9d5S/voXNA4jKeAWt23rm6:FvSSE/n+AXN9jKUt27m6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785265598, "uuid": "75f01c5d-e347-47c7-8c75-06972290e921", "value": 169124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785265598, "uuid": "e0233b06-6451-46b4-b1e0-385fce4703a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785265598, "uuid": "11075ac8-f801-40cd-b291-6f42e50690f4", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c95328-8a4e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220692, "uuid": "7fc654b6-981e-4c62-aef8-ee6b991f114f", "comment": "Malware payload", "value": "7fefde1e3e6679062a6c8209242bfb66", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220692, "uuid": "c8cc220b-d8df-4d86-8c65-fb2b8d1c4ac7", "comment": "Malware payload", "value": "aacf7b93a9e9baaa9db3ee468f3675fbaeef3c48742fe4161f2d93bac3fcc424", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220692, "uuid": "fe4073d2-3e88-498d-b268-1fabd7a882e6", "comment": "Malware payload", "value": "0c08226d1a84e1cbb338a8374a960c19c0d392eb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220692, "uuid": "979a96b2-6c41-4008-b273-150d9fd1d07c", "comment": "Malware payload", "value": "507969b2743ed926757d5c951ea2498908690c7ff14d37517de050735096d58f185b6486be1ae7ddbeedf42d883922d9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220692, "uuid": "fbb62675-9845-45a7-92c3-8dd4c6d25d4c", "value": "T154F1AE8AA095D1B18F3DF7A650F2DFB0C35A29639A78ADEFC0881BC9054CD12570655C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220692, "uuid": "d631b880-d45d-4355-b82b-6b91fda991e5", "value": "192:Zq0r/8mVsh+A4cyuWkzQiTfq8MLIL2fkGjd8NlTUSj6kXHhVw4ya:Zq0rdsIcyujQiTi8uIL4OiC6CVVya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220692, "uuid": "b1537876-7b76-48c2-b7e8-7adc863524a3", "value": 8009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220692, "uuid": "dd92a45c-4c67-4014-a45a-3f6d7fb7f62a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220692, "uuid": "593f1207-ec39-46f4-80c1-75058b90a433", "value": "images_20260728_051143.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d90e52-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785224313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224313, "uuid": "2a168803-c15b-4ac9-a154-e171958e2b3d", "comment": "Malware payload", "value": "f7210d7f01ddffbf8e4eb97e18cca3dc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224313, "uuid": "0d10a7e1-7b0a-4517-a653-a6d9ee1830b8", "comment": "Malware payload", "value": "aae281cf93569cff0ceef08c34244394afc553b143a03e95cce35bae0e97b7d3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224313, "uuid": "c795bf06-bd51-4c96-a88d-d4b6ea33d81f", "comment": "Malware payload", "value": "54df737c4fcaeafe18c24d82f70139372eeb0bce", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224313, "uuid": "d942059a-e409-4bee-b533-dd5c23ed1a55", "comment": "Malware payload", "value": "9bbddc12f056464bae689580a3a58b34c4dbe18221ccec22ce1f5ff86c2b3439ff9955a986971acd1136ac59d8856a8a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224313, "uuid": "ea5603fe-6bcb-4d4f-abe4-8ee45ae0b7f8", "value": "T12141BFCA7A93D97197C7C4381FD6E101E356244309A5AD98B09EBC303F69120FCB1E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224313, "uuid": "5ab9867a-ed97-47f1-8108-72992c92b1db", "value": "48:DVdxxzGG1eCFeZdzVKN5Q1f/neHuDmmlBFInKIYgQAul4N7vGxQ:hdnIu2mQlGaL2nKI3QaTGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224313, "uuid": "ee52f5f8-05a9-4580-a631-6943cdff0b62", "value": 1970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224313, "uuid": "edc9f745-5cb3-4fcc-98c8-604f8cb89a33", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224313, "uuid": "8b4f71c7-6a2f-4fb8-adf1-e731c5b460d4", "value": "loader.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1f2df2-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785211036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211036, "uuid": "58db3e46-76f3-4238-9009-4a382d5c92fd", "comment": "Malware payload (Mirai)", "value": "06343a622d45330634dd90922979b8e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211036, "uuid": "0f547d6b-7db4-47b2-a734-9b368f0f2606", "comment": "Malware payload (Mirai)", "value": "aaee26da1f3affa36cd057d16414235b205a4aa77fca83d6170d236caaf8210d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211036, "uuid": "3dd81a95-18a5-48c8-90d9-a5258f5f3acf", "comment": "Malware payload (Mirai)", "value": "f03fddd8bab479149112a3e3f2ee44db5c831299", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211036, "uuid": "7a8fbaf9-5132-45e3-816e-1a5219fb217f", "comment": "Malware payload (Mirai)", "value": "9a75abf34563c8d044b547f9330b0b2105b2cf871e6431056fac2811066bd33643babef25bb663b66e5b82cf85e04f64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211036, "uuid": "0191c684-f3c3-45a1-ae94-f58c134158a8", "value": "T1DFD47D6377218F54E361D27009F3CBA45AA521A20EE394CA937CC6207A5177D2D6FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211036, "uuid": "98e211b1-ed21-4455-b08f-4e1160504e2d", "value": "12288:sq2E7C7ysMNVAtuGI/0bl4MgGxwRyk1FgpjYKjfJ800:H2+C25Sh4MgGxw31EjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211036, "uuid": "7a647548-322c-44a5-b7a5-0ba35e31ef6b", "value": 598204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211036, "uuid": "bbef8d49-e3cd-4bc7-9819-0bf4b74df7cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211036, "uuid": "613e50b3-01e1-4ef1-bcd4-ec82a60ba76a", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d69bea-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249814, "uuid": "91321f15-5f93-4f62-81d0-6079abc06a76", "comment": "Malware payload (Mirai)", "value": "f07307c0cd1c66e1c4b99b07e9f76322", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249814, "uuid": "2368dfb7-8466-4080-bb1c-462728f299c4", "comment": "Malware payload (Mirai)", "value": "ab329c6c2f3a0a46f329b3404872e7179a5a7b442f1692458c0fd9670c2a7e56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249814, "uuid": "630775b4-d1b0-4815-a872-8dcf083db99e", "comment": "Malware payload (Mirai)", "value": "3e84eb7fd9e75b7962880d6e273e9f0ee3f85957", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249814, "uuid": "e4c833c7-802b-4ca0-a92f-945ae17b25ee", "comment": "Malware payload (Mirai)", "value": "1bc604a3f8a96f62a03a33f159484e62a1c420889294445cfb154d12ad2483c96505481aecaa49c56ce441413423c807", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249814, "uuid": "3b5564ab-4e59-45c1-9614-525c0f95bc63", "value": "T16124B74F6E238F7DF67887344BB35E206A5923C523E0D584E2BCD2511E6029E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249814, "uuid": "f5919aab-2880-457f-8a3b-c71024a6828b", "value": "3072:fhYOe620bh0Z9ACvUTw8uRB4D9UQkbuyh5HWKt2Ry3Edo:fhY5qh0Z9ACvUTwOJ4bphd5tGy3Edo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249814, "uuid": "afb89ed7-e100-481d-8fe2-3b45c93cbac7", "value": 214284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249814, "uuid": "d26b5e5f-4098-42db-b8a4-db6170f421ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249814, "uuid": "220d1068-664e-496f-a1e9-7505068288a1", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9d2b09-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220777, "uuid": "4c2f2401-bf97-4cfd-b751-1aca965bfb5e", "comment": "Malware payload", "value": "b83da5e4d8e822081020d050bebb6272", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220777, "uuid": "6b0facfa-4f10-432b-8227-90a87f200db1", "comment": "Malware payload", "value": "abae72bb6fdd76684fc0c0bb4867d68aff09e9ae97f7bd9719b88db28a4812e0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220777, "uuid": "585d54b9-2a78-45db-8ef3-22c04707f94c", "comment": "Malware payload", "value": "81d7f4d8a9718f1edc8fe230c6d2e19c58327872", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220777, "uuid": "833f7daa-526b-4f98-9b04-af0913d9d771", "comment": "Malware payload", "value": "84c227ae46abc21f0d0758f08151e29a0c6c01affcae9db07f1d6a61b2330588ce213e28b55ff7ee3be2b02b2764803c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220777, "uuid": "702d99a3-ee58-493a-a51f-9b2696b48455", "value": "T14CA17D8FAD975222E48E10B615F60978014DD4DE1127F4F9A8C71F349934AE7239D784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220777, "uuid": "08909f49-3888-4b6d-acb6-55acd75b7759", "value": "96:bOvLBXgt0UjQUFJuJxiwCyooPYW5ASJn9vfdHE2:bOlXidoYBIHnh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220777, "uuid": "d2809e38-bdb3-4795-a83c-9bae3a7c53dd", "value": 4668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220777, "uuid": "81351d60-22c9-4bfb-b8d2-aac71dc727a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220777, "uuid": "03968010-843a-4bcb-b23c-4b9b84fce44b", "value": "images_20260727_222010.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6adb5ec-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221066, "uuid": "e8e5f5f4-f029-48a3-ba83-62368de39d51", "comment": "Malware payload", "value": "23c519633128d1c7bf720e148b612b52", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221066, "uuid": "aae21e12-24d0-4ae3-980f-cbe92288aa4c", "comment": "Malware payload", "value": "abdb93d08a89693393a57526567392128c6da12bedfaa6c8868bb7c65fe294e5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221066, "uuid": "9828cb60-eb92-48f3-9bd7-6b6181349f45", "comment": "Malware payload", "value": "7f25361d1dce6e437fd5bb91b6321750d9667fb6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221066, "uuid": "13884761-f37e-4eb7-9187-0f2b3568f4f8", "comment": "Malware payload", "value": "e9758472e0072904544363bcba32881911a847043e7f76bafdd52b0568f3ff76e5a58f1c770f026e418d102ba92a888c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221066, "uuid": "c9f6ec5c-3e96-4790-bd12-89f118005ad1", "value": "T1CF02BFD94E24204BC4F28577696C2C0F478F0D968F5F22A183CD013DB1EA2B4266B2F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221066, "uuid": "b4293a2c-6173-4df3-a415-eaf794103cc3", "value": "192:JNuJXGPaO7cyDFY7daKlvBXJtKdE+RZaH2jJKQ1L7MqoRYFdZalOz3tb+:JwlGPdcyDuBXPQRZaHK5IDRmYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221066, "uuid": "343833a4-048f-44bd-99be-2781add2b542", "value": 8387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221066, "uuid": "fbd5f046-7fbf-46a1-8de8-9addc79cd410", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221066, "uuid": "e5c352c4-701c-4ad1-80b3-519c873c4229", "value": "images_20260727_144558.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889f88b3-8aa7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785258758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785258758, "uuid": "1534c221-66e0-4e4d-8c2c-c8586a9b0305", "comment": "Malware payload", "value": "9f5c98abe3c2328873ab0b5409430731", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785258758, "uuid": "986fcaf9-dcfc-4383-9f81-3fe591016598", "comment": "Malware payload", "value": "ac06e792e83d4c3293f01a69d0aa632bf59a5e41857e32803502f9e86837c20d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785258758, "uuid": "5466d83f-1c93-47d4-86ed-4472481f4c9f", "comment": "Malware payload", "value": "fd4a99ee755a14684dd46bf6baa5aba4dff99aad", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785258758, "uuid": "191abea2-a7c3-4710-9699-9c607279749d", "comment": "Malware payload", "value": "75c73ed44330b545712890cb6f608275f2cae3a478d98d8621ce8b1b484942163c85912c4e4154601dd201f5f68a27c7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785258758, "uuid": "42723f7c-6f58-4b01-9f39-5d6311ab7562", "value": "T11305334FECE3AF26BF3557B173630AB9DE0CE21D0C9774E65E22B6410446109FE8AA15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785258758, "uuid": "fe1fec6a-d7e6-44c2-9288-b8a213df8618", "value": "12288:jML7nvXmvK+nSh3MPx6QS+XyxolbPluy0ElbM0j5ph1S1H5lCIh9CLTw7PqfFXX3:qmvK1h8PAr+XyMbPlVMyfh1k7PqBX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785258758, "uuid": "c167ff95-285d-406c-8924-68642c54f157", "value": 852376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785258758, "uuid": "3eec61ea-ee35-4429-8606-29fa55c7b490", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785258758, "uuid": "1859b427-ad18-4700-be23-378741a25267", "value": "TransferenciaXdeXpago.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c940156d-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785245981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245981, "uuid": "4043a9f7-1992-45a6-a735-0028230f0188", "comment": "Malware payload (PureLogsStealer)", "value": "942c80896e0fc15cc57e9966941adb8d", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245981, "uuid": "0665b8bf-491b-41c4-95a7-408c1b92190d", "comment": "Malware payload (PureLogsStealer)", "value": "ac2b8a0539b5d3bd13333ed2c7ac3a3f6819e07678397c71c2f7a32f9e6615db", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245981, "uuid": "a533c9fa-a7d4-4f6d-99d2-31e62f196ea6", "comment": "Malware payload (PureLogsStealer)", "value": "97b7fdc35affbdfd5a5b21999f0d3f1a721ccf44", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245981, "uuid": "f973f534-1987-4e5a-be34-301b41dcc919", "comment": "Malware payload (PureLogsStealer)", "value": "a3513f423746b34a82b235e1923f3a3643b744de8fbc8652ca05a0e74f3b1c84635410570e7b383ba1ab71f0e6ccf088", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245981, "uuid": "202d2c02-00d8-4580-a773-cb40f9b7f30f", "value": "T109A5D015E3E152F8E227C134C6964233F7B678510760AADB325CD2692F3BAD46F3A721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245981, "uuid": "d836fc7f-3fdb-4513-a1cc-04581c521f99", "value": "24576:XY6TYOe2pP1y2DjTHcmQhPT+mP82giMIRuTv+JmQotrGh4t/MMoe1wLwin5MdxCa:XY6TYOEmQB+mmuOG4QUtkMJWLwa5MrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245981, "uuid": "846f8ac7-9978-4ed5-99f3-aa833f9151ee", "value": 2191360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245981, "uuid": "2db7e779-9d57-4f73-a9a6-972034cdf15e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245981, "uuid": "7ff28e25-fd2a-4bc8-ab3a-7ed3dfd6d758", "value": "ac2b8a0539b5d3bd13333ed2c7ac3a3f6819e07678397c71c2f7a32f9e6615db.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a6033c-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249713, "uuid": "9bec342c-221c-455e-9b00-52ced6d1d8ee", "comment": "Malware payload (Mirai)", "value": "6b4da1e3a33005bddc919355ec90a3ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249713, "uuid": "95ab3259-c966-43b3-93d7-1ef34128e1eb", "comment": "Malware payload (Mirai)", "value": "ad235db42eae7d25db4a119ffa33fc562eefa3c1057b8a7672ad008315268e21", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249713, "uuid": "4057961e-7b17-4358-9b3b-98471aa6f917", "comment": "Malware payload (Mirai)", "value": "752834588514a88504f3871ce011ff12337619e8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249713, "uuid": "6d2c348c-495e-4724-b73e-916895232991", "comment": "Malware payload (Mirai)", "value": "9b500b5084e7fcd67b3d0edcb76b1f7449fcc5160247d3a800b76c6091299cafc6c39eef4b0353ea9bdcaca172e5fb4b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249713, "uuid": "ae22f2d5-19d8-4b97-bc22-860680d970cb", "value": "T1B733F168F8CD2A1EEFBC58B14D51B7287F529BDEE392CCA2D4E1D225091C5F90E1C885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249713, "uuid": "bd60646f-149f-4770-a438-5600e3c6a35b", "value": "1536:5744/vo8hDRhVaMTjl0uHDI9LIdGpaBS5FtReoCA4u+qgw092:5pvz9hwMxHDGA6aB8r4u+qgwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249713, "uuid": "c2d70187-bef4-4572-863b-116d216a84da", "value": 54276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249713, "uuid": "a63068f9-5f6e-48f9-a024-c9ebaec10803", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249713, "uuid": "54dfabf7-c9d5-4125-9baf-beb4f33b5d64", "value": "zero.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb62d72-8ac3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785270686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270686, "uuid": "c4048e83-6274-40e1-a7bf-7da222803b2d", "comment": "Malware payload", "value": "832b8c806e8ada7badc460b765395652", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270686, "uuid": "b254104f-696b-4682-aa3c-fa9a04ee8002", "comment": "Malware payload", "value": "ad402539ef20003f7fce7cb87a0549f04d78c8c066c26c2cba032ee329705ed2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270686, "uuid": "e597c6dd-6ca9-4a1e-b8fe-9fb8d3f69cf8", "comment": "Malware payload", "value": "776afd118b27365c7de155e835d6c205c8f0bc00", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270686, "uuid": "e0deadc5-ad00-44ee-9bbb-062ee32b6ce6", "comment": "Malware payload", "value": "c013ca500c41d8dbe5d6ea1c6a4f6e0f03ef495f1bbe558dd616da4c350f54d53ad2d3936730df1e60243c6bb4d56bda", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270686, "uuid": "004d8011-9acb-4ff8-aba1-b6a9ceb51c15", "value": "T121955C45EFA2AB3455472F82115331CE3BA11FB498518361FBA8654B3646EEFF87A330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270686, "uuid": "9342f50d-3f98-48f0-ae27-938c4a738bdb", "value": "24576:p/eWxpB4YWJ4yqnAGvW19Hsuk8BRjTM637ZV4NN1tTqW35bUmtu9TYiW4lkijGvh:p1zaNEFOj42iN1t4moYt9guwU+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785270686, "uuid": "9f92c0c7-8983-4a44-8705-b2f9cb2ea578", "value": 1932849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785270686, "uuid": "6bc47fe7-9791-45e9-b50d-ba93a5de05a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270686, "uuid": "7941ef15-c893-467a-aace-0adfab8bc33f", "value": "Purchase_Order_28_07_2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9445380-8ac3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785270838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270838, "uuid": "c0a8e7a3-c529-4e71-9c7f-22ff44826296", "comment": "Malware payload", "value": "28954d2e39f29e67359abbcc02a3bd91", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "junction-equation-kodak-counseling-trycloudflare-com", "colour": "#1DAAA7", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270838, "uuid": "8c8128f3-14dd-4b9c-bb94-3b51f2d7ae77", "comment": "Malware payload", "value": "ad87c521a094b77faf0cb2c0da769b619dbdb567039eee489fcfdb13a23ce124", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "junction-equation-kodak-counseling-trycloudflare-com", "colour": "#1DAAA7", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270838, "uuid": "b473ed6b-6c7f-4386-a473-704163b3112c", "comment": "Malware payload", "value": "72c6da777889c4a4801dc7a313a1b951e77a9372", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "junction-equation-kodak-counseling-trycloudflare-com", "colour": "#1DAAA7", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270838, "uuid": "6a2d95fc-ae84-4828-8450-25e941cfa2ce", "comment": "Malware payload", "value": "eb82a40bf2a248ee7846b72930362b522a239b180bd563d1ea32a7709c07f7ed67975de3f5ce88d80e1a5e58cfcfe44c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "junction-equation-kodak-counseling-trycloudflare-com", "colour": "#1DAAA7", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270838, "uuid": "ceac6ad9-5117-4170-aeeb-a11d9b90e8f9", "value": "T102E0C2456A14D0D0986667D2565D82D881B806822C15F2ABFE508BC65E7B67043D4D8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270838, "uuid": "4f318342-05fe-45c9-aa42-0478e075074f", "value": "6:hFqrTFILwCfLKzd+2iN7yeHdxRRMes2/eQSAqoUF045:rqrGEGKAHNJHdxRps2/eQSAnUFX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785270838, "uuid": "c495aea7-bf00-43f2-b6d9-6a0df6e822c6", "value": 295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785270838, "uuid": "927c768e-7bfb-4514-b197-8cf788dcb09c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270838, "uuid": "c49966a5-a6a3-4292-8763-9116802ab70c", "value": "kol.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62035046-8a47-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785217461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217461, "uuid": "fd50eecf-eb93-4e9d-bc69-af6a9cf3654b", "comment": "Malware payload (Mirai)", "value": "45655eea57acd044bddf1f1e175e5229", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217461, "uuid": "41466cc0-6fd0-4bd0-969f-523b36ec82c0", "comment": "Malware payload (Mirai)", "value": "ae83cd9bf08b70e12542968b3967e8d580aa10a18f77d05fb28d95c9b4a934eb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217461, "uuid": "725af679-1f7e-436a-9e0b-a67b32dc90fe", "comment": "Malware payload (Mirai)", "value": "79b8446fecf3e3053e1c7c4abce9ea4fd4fc631f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217461, "uuid": "c5a1afaa-4525-461b-80a8-dafc6ddab9bc", "comment": "Malware payload (Mirai)", "value": "58ded57f9262a32e15bc092c83b00c7678530fc2394dccac0cbc8ca0778d13938f47ef9cdd27d61ae007412a342b92d5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217461, "uuid": "eb52aafe-027d-487b-96b1-a5b1b5c98c33", "value": "T1AA01AFDBD0749900409E991E22A75194F471C3C6174B4B39FFACB83EAB94D14F466F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217461, "uuid": "97643efd-cc6b-4d9e-8816-443696974918", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHka21CM5WYCFB23FClOChJSXm18CR5GzX:kXCKysE2hi0ziQvZohaOdDFxUXmWQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785217461, "uuid": "664f1f48-6f23-4f30-aa60-e589e34dff42", "value": 848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785217461, "uuid": "e1821633-3f0d-4171-a966-d2254a407197", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217461, "uuid": "e2140a4c-b9d7-405f-8bd0-2c4dd9e897de", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d49823-8a79-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785239053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239053, "uuid": "45358abd-9c7b-40cf-9a11-70184a979337", "comment": "Malware payload", "value": "c90f62f52f19bcbe25cf621ef8035109", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239053, "uuid": "0eafabf2-6b10-4408-9ad3-546e8607cf3d", "comment": "Malware payload", "value": "ae9074b54cceb81f84b264bead6d71e9b6428c8b52a7c5f511cd04314180bcf8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239053, "uuid": "6a847fb7-e5c4-4cb3-b202-7a7344397604", "comment": "Malware payload", "value": "134fec79c0209602ad9bb6c1c2a6fa8d9518a2cc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239053, "uuid": "508dfd03-24b8-44fd-9bee-5cfa9cb20e11", "comment": "Malware payload", "value": "6e5ffbfb2074dac660e6ead967f9a8477fcf5a8b8f61e67b31246c230f226042df27e9f68c731fc028d0adece11de202", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239053, "uuid": "8b849c68-af76-4501-aeb4-751295353c7c", "value": "T176236C651A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239053, "uuid": "efa443ca-75c9-489b-b9da-264a02c6fe68", "value": "768:sXRWNGxVy9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Alx5cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785239053, "uuid": "a48a234e-ba02-4909-ae5d-06c41d62f700", "value": 50035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785239053, "uuid": "cd1682a4-482c-4ddb-804c-408b1d0d5d8f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239053, "uuid": "cbf7ce00-5440-4dcc-aea8-505c79132e09", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce002f6-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233210, "uuid": "f57b1199-0548-42a2-8db2-8131dc59aff9", "comment": "Malware payload", "value": "61452f215bc3f5d0f500b06055830b3e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233210, "uuid": "ba212899-5f09-4f3c-8148-147483a49a45", "comment": "Malware payload", "value": "aed136eb126f89f36d3860af3a604e962ef7cf11e576e56cf271fcf6dbe44f0e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233210, "uuid": "9982795e-b1e5-41ea-9f43-63761364691b", "comment": "Malware payload", "value": "eff9756b395571d46317713f943dcaae9dca901b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233210, "uuid": "f90a5b71-dfcf-4fba-a154-491e310820e1", "comment": "Malware payload", "value": "f75df7e86bc33085aa38fabc640144ee1d4f50f2b7a13580d4bda09afe049506fd4de44099adaeab546f4c2834647a31", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233210, "uuid": "659cc59e-4a72-4901-8e15-0368d3e240fe", "value": "T10E42BE3BD145074FEBC241B498DF89181AFC31A0A55B3ABB35AC084A19A752AD50760F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233210, "uuid": "051f7e6b-4a73-40c6-88c9-f9f4fa390d01", "value": "384:QmYJVGI+bPX/gomi5sidljd1lLDZBlQi6Jp:Qvr+bvjD5s6lj3BG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233210, "uuid": "084d4777-b374-4283-8428-03f04a7ee790", "value": 12791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233210, "uuid": "6af9fe24-c7c7-4a2e-9449-05dfd7eb6091", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233210, "uuid": "f3a04a9f-ce92-45ce-b1a3-e601dc094e10", "value": "images_20260727_202732.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce73eb7a-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785211201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211201, "uuid": "49dac95f-a5ab-4d44-bbb1-48905e5e9b89", "comment": "Malware payload", "value": "a4a32db64816e5823215076682032873", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211201, "uuid": "380e4597-cd24-45ff-92b8-dd6bb587ec2c", "comment": "Malware payload", "value": "afa39766846c6ca29d124adff8a164f10c9454754ec0fab4e9c1683165ab37b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211201, "uuid": "195d283c-7f1b-42b0-87f7-eeabcade189d", "comment": "Malware payload", "value": "d939aaf417872b7c648fde2f7a4c987a4661f965", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211201, "uuid": "7bacbd9f-f1f0-41c4-80ec-1d466c8f22de", "comment": "Malware payload", "value": "45face90be016aa7f8cbd6bcb6fd2414b74ae6260a67f645c31c526134742c2f453a89829ec08602db81d85fb799c9b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211201, "uuid": "e603b21d-8c82-4e5e-b1db-2553e1326dec", "value": "T1F6058E2BB2B3B27DD017C0304BDBC6714532F4756A322D7B26C4DA383E96DA51B1AB25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211201, "uuid": "fed09324-8a30-473c-b0ed-727bf777e2bb", "value": "12288:j2fraSRhCNNc1sojBd0H5/TfzFXKMbayE/r+HX03jtD6z+x:ShhCNNc1BezFXKPjtD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211201, "uuid": "0b48223d-7a3b-42bf-a06e-632913b065f5", "value": 798968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211201, "uuid": "31f37a73-acfa-4ba9-a8bb-506c8234a6f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211201, "uuid": "ef745691-3287-4af5-931c-0956f9ba70d6", "value": "dlr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32d45f4-8a7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785241757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785241757, "uuid": "6df1df7c-5ca1-4ac0-b6b6-e9c81f8a2084", "comment": "Malware payload (PhantomStealer)", "value": "d2b2d3e6eb391a8333d1e7cf9e64d8ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785241757, "uuid": "307046d5-aa39-4fda-ba44-798f6fe13667", "comment": "Malware payload (PhantomStealer)", "value": "b0196d8a25ab7bbb1c9185161e978f21ec473d482cbc9c60cfca0c0c587c9e24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785241757, "uuid": "2f3f78c4-771f-463f-9d80-4a16b69408c6", "comment": "Malware payload (PhantomStealer)", "value": "fa5696375bd318fb9bdde6ff81d20ff2c0faeba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785241757, "uuid": "17317f96-b0e0-44a6-bf57-3f28fd012522", "comment": "Malware payload (PhantomStealer)", "value": "63c6b5dfbca80eac0b9938c584a9aa419a9521d54001d1893e689adffa34f8235fd00ce886332dcdd83d2633e6db8415", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785241757, "uuid": "06706c0e-a54d-4c66-b64a-19b5b5f4cdef", "value": "T1BC26F8C297A0AF7E7BA1AB8CA537DA28430D110308C5DF29319ECA15779DD079349EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785241757, "uuid": "e9a0d266-3ca6-4a7a-b842-8b13c123cd88", "value": "98304:yLSZgbxMf9Mwb+M64m2pPw9boeDsWfMg8Pd+WteIxyDvNqsS8H9UZkRJCr3D:yLSZ02fewAYi9bdhC+4UHscSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785241757, "uuid": "28b07083-f77e-43d9-9299-dd7ad4b0b7dd", "value": 4474181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785241757, "uuid": "5a7e45e5-f1c3-4724-8ab9-c3b61c76b141", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785241757, "uuid": "a4af185c-4e0c-46cf-b2b2-5a6fb49996a7", "value": "ENQ-4503-RLVG-9-AN-0503-003-R1-DD.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75afbdf5-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249706, "uuid": "7ad61732-0aca-4121-89b8-310a3686ed2d", "comment": "Malware payload (Mirai)", "value": "2a3f3ff57ac02a3d0d00ea64d2acbcd8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249706, "uuid": "18efdd05-a42d-4cc2-98eb-a713e562d874", "comment": "Malware payload (Mirai)", "value": "b0427a95938cb310aa4f4a5404acfe7811565e16567deb9456992210c4415774", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249706, "uuid": "d7889501-9f72-478e-88b1-91d60e56af0b", "comment": "Malware payload (Mirai)", "value": "8a31f55308242bbcdd7a78c73a0dbbb62214f548", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249706, "uuid": "01b19353-303f-4760-8261-7c1a5fae8317", "comment": "Malware payload (Mirai)", "value": "3ca96fc1094b9f2de6aea8a1353dc81f3d747e7abc2f44c8b86fd71831a972cc96a888c2f4e26700f089f56eccf592bf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249706, "uuid": "a5ddd59d-09e6-4855-a79d-182ebc25cd48", "value": "T1CDE3AE27B24B1450C89541F556EB9B5E3B7315809FAB5AEBBCBE233EDB724CA05007E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249706, "uuid": "576dde63-7e07-4f2c-99cd-1e3b7048fef5", "value": "3072:090xB5gjUXY/gDLPH5BFf2htjtgLfOqbw4TNxgJCTWCF5sFuq:W0xB5gjUXvx2rjOrlUyiCTWCFEuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249706, "uuid": "370bb6a1-cc9c-474f-a14d-88ddffc6c9a4", "value": 157132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249706, "uuid": "080fd366-e536-4def-bed3-8d901eac20b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249706, "uuid": "b0fa3719-b845-4242-8768-b2f262a5a6b8", "value": "zero.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6f5fc9-8a1f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785200217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200217, "uuid": "3b9a3190-7375-460c-8820-374dc191227b", "comment": "Malware payload (Phorpiex)", "value": "5734b587edb55648f7d0b461a3f3c466", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200217, "uuid": "34c26176-c269-46ad-aa24-4776bbf8b337", "comment": "Malware payload (Phorpiex)", "value": "b06316fc674d62db99afd11be3ec60eb212fd0e64a23c20685017fe7d7221f5d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200217, "uuid": "a49a2bac-fe03-41c3-a7d1-840d724691c4", "comment": "Malware payload (Phorpiex)", "value": "3b10ed57ea261a2587473b558826c4e4587cdc57", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200217, "uuid": "a5493490-4bbd-4ee0-8a17-57b2d8be908f", "comment": "Malware payload (Phorpiex)", "value": "35cec26d40444adc8587e0826c36fbb80b414deb982f9c02b12c8e50232b0985381ced21399bc1542177ccea8df8134a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200217, "uuid": "f66b96d8-e6cf-4676-b0c9-805c2c7daa31", "value": "T19B623A0AB4818035EAE04075827F526649BEADB623C4F9D7F7E0A8C94DB4BE1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200217, "uuid": "92dedccc-8012-4219-993e-116bb45e5e61", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200217, "uuid": "96cba0ad-6fcc-48d2-a3b6-8853bef7a5bf", "value": "192:AWFsGnjXgjk8LcRI+Q1RDMlYfV/F5oIVUBKUSftzQFBrfgJxTmv8U9cthv9ik:AQScCtfV/ro6toB0av8U9c1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785200217, "uuid": "6a90e409-d517-477d-9fef-28534991f27e", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785200217, "uuid": "722ba20e-d13c-47b0-89aa-45b712f47bcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200217, "uuid": "6807fbed-c4f7-471e-911b-f1a8a8418e7a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417bd59d-8a96-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785251337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251337, "uuid": "0f12917b-6499-4388-b4e2-89b9ef5c81cc", "comment": "Malware payload (Mirai)", "value": "c9720aa9dd4285d9f14eea3553b575a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251337, "uuid": "7171691a-7ce1-43f3-b97b-bfe3c9145c69", "comment": "Malware payload (Mirai)", "value": "b0e84da839f0fbaaf40b46ce556ff59716630d7d8f6301e53dc2e455d8c93f3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251337, "uuid": "a6498ac0-d1af-4bdf-8e7e-6c12eb9c9f55", "comment": "Malware payload (Mirai)", "value": "c47b0900bfa7425aad9f762cf132579f646917d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251337, "uuid": "c3a73201-ba74-49da-8048-31179a8e5656", "comment": "Malware payload (Mirai)", "value": "c5e23e1630eb50f524bbf11c1d9cd5cacbc0c93685d7625541b744ca7136c0c5b8cfa7370022e31b7c3bf089607d8ba3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251337, "uuid": "71c74ec0-73d3-478b-ae21-47e413dd21e5", "value": "T104E3F649ED41AB00D5D636FAFE4E428973631B6CE3FE7112DA245B2523CAA5B0F7B101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251337, "uuid": "512ba15d-6b91-4468-8d13-a18e49494a2c", "value": "3072:AN/PKS04KrmlSmZcJY/LTIO17tLrRIaBG5DovF/17iv/YPRLjgUR1Stdmrh:AN/PKS04KilPcGAW7RdIaEpovF/17ww/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785251337, "uuid": "8a24d853-bcbd-43ac-8913-53313a9e2fcd", "value": 144228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785251337, "uuid": "e9ec77e4-6734-4469-b597-e05c4cff540e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251337, "uuid": "608a2687-8b2c-4667-ad6b-771788e6433f", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41c56b6-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785224525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224525, "uuid": "5fc2102f-dfc7-47b7-9ec4-aa5e483d79a3", "comment": "Malware payload", "value": "e5cb370d4d1353f8d8174085ee641d92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224525, "uuid": "9ea7a186-c51d-4dd0-a7ab-70162a5dfc6d", "comment": "Malware payload", "value": "b271c77ef818841337f56e79350f8f1cfe622662a38a11614b1054b299c124df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224525, "uuid": "ac57b110-a619-4ff9-a097-4b438ed4b27c", "comment": "Malware payload", "value": "83ae187e178a2cf6c6da7435140e94f8c433e0dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224525, "uuid": "c105681b-42aa-45ca-b6eb-948ffe8b0af3", "comment": "Malware payload", "value": "f12dc034b364e898dac7bf90ebe90c0c662a481e033e1fbfe395142937bbf6c1773ee7cff4c7a13b54a6625f3ce72fa5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224525, "uuid": "ef09b3b8-85b7-4604-afa0-5ac4ac81c045", "value": "T11026185BB9D25982C4E43637B8BE80C433635EBA9B8752576D05FE383ABE1D90E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224525, "uuid": "f576e476-a6b6-430c-86bc-9dede5417e1f", "value": "49152:PQTTuqkP5ZVUpfaDAPCnSfddYy9VS5d5Rmn5Ed:4TaL5Cm5dy5Ed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224525, "uuid": "bd11952b-c225-4d04-a615-45996e87f9ca", "value": 4784276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224525, "uuid": "aaf8dbe3-0bb9-4ee0-9e89-63261416dfb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224525, "uuid": "eae1d446-cf5b-4f3b-bb8e-e83451088a91", "value": "kblockd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050e4c95-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233197, "uuid": "fcd4d92a-9d1d-4012-99c6-a27e50ab6dbe", "comment": "Malware payload", "value": "44ea6762eeca371e84bc81ea478d6092", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233197, "uuid": "bb813a04-4265-4729-8822-986afb284fc6", "comment": "Malware payload", "value": "b2a50e5605bd7ee6639b22b09986d8b5cf4cf231fec51f4e09c37ab3a4a007a4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233197, "uuid": "9873afc0-1634-49dc-855d-d76d414c49df", "comment": "Malware payload", "value": "efa114c033b3f9abee41ea77038d04ba7e3f8022", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233197, "uuid": "8a9c1ab2-b8f5-4f0c-a54a-a3539651f484", "comment": "Malware payload", "value": "600c0222604d9fd46e5201e7761bf3298b680e07591707f9c252cacae17b629e3376abc41f99455ae787f6bfb2c0b57b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233197, "uuid": "3432cf04-d4d2-46cd-86dd-ba296617af83", "value": "T13402AEB9FEBCE187C846AB7E70F0DEDF4B928E802854432859345C64DCE9483602CE62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233197, "uuid": "0aaa6711-9126-4b39-a40f-7af768f1eaa5", "value": "192:Jl6nocT1y9TqrtVSVpaDiO38v9DnFhVYa3psWDrf:JM1iTqrtVcU81FhGa3ZDrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233197, "uuid": "25f25938-694c-4ce8-86b4-7d582da8adc5", "value": 8227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233197, "uuid": "cb6f22f1-9ad9-4551-a07b-4ed9b37d6b3d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233197, "uuid": "c690feaa-fb5b-4708-997b-b8773a678643", "value": "images_20260728_063621.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42147721-8a73-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785236305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236305, "uuid": "94a615b4-6d87-401a-955f-ce80257d4ce1", "comment": "Malware payload (Mirai)", "value": "46971e232a31159b1cb0bdc6c2c6436a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236305, "uuid": "a09ed161-a4d3-4f2a-8aa8-36e5801d89d6", "comment": "Malware payload (Mirai)", "value": "b422b7a3c3745b3ae6dd34b4e555db2b234b90192345e0bcc9de2390a906f339", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236305, "uuid": "febe004f-153c-4820-9ae4-3617e13d2106", "comment": "Malware payload (Mirai)", "value": "43538998bcb1c17c525175354a81fbf4b9b99922", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236305, "uuid": "551c1865-31fc-4e81-a507-47ed839d42c4", "comment": "Malware payload (Mirai)", "value": "8bdecad4e9a4aa2ccf9f4b2dde677452e672f4c1b1585edbd6b736a2d60260ad7a4cf012f63b4a46e53917f9718c569f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236305, "uuid": "d7ef424b-5565-40af-8b5f-1e3d3d1d06c1", "value": "T122016BCAD160991040ADD99D32EB5554F831C3CB168A4F65BFACA8399B8CE04B037F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236305, "uuid": "77f18d58-7936-4516-91f7-5be1bf091139", "value": "24:kXCKysE2hi0ziQvZohazLZoonv6FxMi807oSKYX:e9Qp+MszLuov6FCi807nKYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785236305, "uuid": "831e44fb-e38e-464e-94fb-db57ba339bad", "value": 840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785236305, "uuid": "69ab9717-34ea-4150-9ab5-4834523b11cf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236305, "uuid": "61ed566c-9688-475d-af8b-d9d23b4ee1c0", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78ecf3f-8a86-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785244717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785244717, "uuid": "596f783d-a43c-4695-a053-5024acbe04fb", "comment": "Malware payload (Mirai)", "value": "927c73b4d72e4d487fa3f42e8c5e5eac", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785244717, "uuid": "ed232cef-afbf-4879-85ce-e1e2b817ea3f", "comment": "Malware payload (Mirai)", "value": "b5497b2c9b6a0ea89688e018306536652081b57a916dba389fcb287703c17d86", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785244717, "uuid": "1fbd93ff-48f2-4be5-bcfa-d2f6b86d6ab1", "comment": "Malware payload (Mirai)", "value": "5c571bdf72c4a6f17b77c721db1ee76c2b28bfd4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785244717, "uuid": "1445d8ff-8200-4d49-836e-b89acbb73023", "comment": "Malware payload (Mirai)", "value": "776cfdc086bb0b8fe38af05fbac2ab904c84c5d35432eb4c0eb9090e44b62d173ba7d75c6b735192f61e56cacb2ef341", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785244717, "uuid": "d9faed8c-7097-4632-a0ea-f13b215388aa", "value": "T1A58167D7B6705E30B48CCA7970ECC8A926C63CD9E0D63974F4DA7CBA249CE647449632", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785244717, "uuid": "02a46a22-5e0c-4ffb-808e-2e6a4e9a49d5", "value": "24:I2iMzM5a1ZKyKpCj6L3j29242G5G/X/oxr:HZM5a1BcM5G/X/oxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785244717, "uuid": "ac0c9ab5-98df-4c6b-8fbb-309b4a36ca4b", "value": 3906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785244717, "uuid": "a1622003-1416-4c72-9302-40b1aba029e3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785244717, "uuid": "bd075efd-5da8-4ffd-83d1-23fed1c139bd", "value": "b5497b2c9b6a0ea89688e018306536652081b57a916dba389fcb287703c17d86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7588e6fe-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785211051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211051, "uuid": "e1932f37-5250-46d9-a6b3-29ff4f897a40", "comment": "Malware payload", "value": "0b1acda471c11ba42c68772565572a7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211051, "uuid": "82ef2a64-baa9-490c-aec5-22102e2e3097", "comment": "Malware payload", "value": "b6ff719a2e45ffc9a07c466a0132f930d0caf32b6691aa2436cdf4d3a4b14810", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211051, "uuid": "1f29554a-67a0-46f9-b5a7-1e1f9cf0cca8", "comment": "Malware payload", "value": "e889c553e33f0dee16551956debc008e447ec629", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211051, "uuid": "a4ceadc2-0d4d-496d-95f3-5fd66e7324d9", "comment": "Malware payload", "value": "6a23924c2f1f7d0e7506f0de2391138e0ed73e3cbc1634ccf70bcd1aaa3775b3069e29549bdd66322da03b59cc6e35f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211051, "uuid": "0cb6b564-00e7-4cfa-8a62-f0a317711176", "value": "T1C6F45C07EF505FE7C49FCD31492EC30601EDD8834AD2662A71FC8B8CBA9925A4BD7598", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211051, "uuid": "0fd81f74-d992-4501-a1fa-476d95684498", "value": "12288:qt6VbBK3DGS1pQGbxZ+LkjsXHg2fe9P/Z85KG8JEAPkNGxizYR6D2IONUC0aASpn:xZS1GvJfe8ieCXb80EyTV5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211051, "uuid": "03eae9b9-a8d4-498e-95a3-1e352114d20e", "value": 761688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211051, "uuid": "3ad31c7c-5e35-4bf0-ba7d-4d6bb64d49f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211051, "uuid": "3f9441ec-6a56-40c9-9f53-2ae9996e7053", "value": "discord_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cede5c1f-8a7b-11f1-bd95-42010a9c0009", "comment": "Malware payload (IRATA)", "timestamp": 1785239978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239978, "uuid": "f23b435f-2e3a-48f8-9a89-c65a527054cb", "comment": "Malware payload (IRATA)", "value": "3cded602dc6eeae332cfb4efc766f981", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "malware-analysis", "colour": "#279256", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239978, "uuid": "fdaa4eb5-0cc5-4c34-bdb4-4d987b6cd1da", "comment": "Malware payload (IRATA)", "value": "b75594885b4382ff7fdce4cfa890bb3c47b576bdf47a3ebe5f08352fc1df5790", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "malware-analysis", "colour": "#279256", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239978, "uuid": "3396c4b9-5663-49b5-ae97-7213c9e32958", "comment": "Malware payload (IRATA)", "value": "c3189ad45becfc7f80bc0d3b7271b3a39c21e5a6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "malware-analysis", "colour": "#279256", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239978, "uuid": "9b8353f2-906a-4c06-87d1-cf65ccc71677", "comment": "Malware payload (IRATA)", "value": "1e6ff543cef2dcaadd6c8bbda28c9ec38d2692c2fe0d96d2badcdad3a67c7e2a345483f3ffd2a6084ca5dc2c0dcc0d19", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "malware-analysis", "colour": "#279256", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239978, "uuid": "189b6e3a-98d4-4912-b4c9-470adb1d4054", "value": "T16E863302FB927DAAC4E6D33011B9172660364F55930BA78B6370B7F928B7BD85B431C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239978, "uuid": "796240f8-b323-4daf-9d4d-e0378055bec1", "value": "196608:+C8KA9chuzXZOoIOtT79UwruqBtEKwISLCjTUnUSV8+/j:+nKAlzooIylmkEmTUnU4n7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785239978, "uuid": "cfd1fbfc-74e1-43c5-8eb4-19dac48661bc", "value": 8061368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785239978, "uuid": "f6162cb8-c8fa-4abf-bcce-ae698c3b9f9b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239978, "uuid": "c696037a-a329-4d0a-9af4-93c5e7ca9b0c", "value": "Digikala_job.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4d715c-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233205, "uuid": "b20f849c-08b4-451f-8f06-cfc8cde08128", "comment": "Malware payload", "value": "bb30d02aa9f3b179aec6a9d117cb8ca3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233205, "uuid": "837e6b4a-9b1b-430c-8ce1-34680a9c0c11", "comment": "Malware payload", "value": "b77a8f3ef542fd4ced3cd9ff372255ba95e7ec5208a415636bcd4f023440c5be", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233205, "uuid": "e9cc1551-b9c6-46f0-b8e6-eb1c9feacdcc", "comment": "Malware payload", "value": "82a8193ca2a855accdc85a85435a113532c22e59", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233205, "uuid": "0e8df46b-9760-4409-af14-84c2c423f311", "comment": "Malware payload", "value": "48be27b96d215ccf03e6696f01ae0378f59ecd4db472e9fb676e54c02bd3334820fe9ef79cf26ee3124f229febec56f4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233205, "uuid": "0bee0892-e7a1-415a-a81b-6150a703dd99", "value": "T1AA12AFC654E1CF6EF59755B764BB10EC4CAC9EB72868878B849B89C0AD88351071AAB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233205, "uuid": "2b6c2718-f02d-4766-8e08-d20921313507", "value": "192:8mAq4MpD3R7j5snxrh6mWFDVV8OHQSI8VsLjRgiSwEOxZaDXXDIdSW:vAk/aHNWFDVSO/sLjq4arD4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233205, "uuid": "d1fe74bb-ace9-418f-b589-f1fb9e4781bd", "value": 9819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233205, "uuid": "b13f6e07-3d1c-438c-8d64-75862d3afce9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233205, "uuid": "f62dba3b-66e1-44d5-adb0-fd5e1919654e", "value": "images_20260727_213802.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d54d600-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785224325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224325, "uuid": "6238823b-6e42-4a05-ad1d-fa9af6dd0f5f", "comment": "Malware payload", "value": "567d69965b401250da2bfa21004c1d78", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224325, "uuid": "87f39a8b-9ddc-4a1c-882f-d8a1f29a5d50", "comment": "Malware payload", "value": "b7c9e0cacab7c44f24929c96e0112bf56e2e74017046f5c13aef1492984116e5", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224325, "uuid": "f953d896-a39e-414a-af4f-0d151002afc0", "comment": "Malware payload", "value": "afcf5465bf3ce729cceb613aac01c74841f223fd", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224325, "uuid": "c909529f-0724-457f-a462-979b897fb76d", "comment": "Malware payload", "value": "fc11047cceddc4572f44f057ea3e00fc7125c6b9f9cc39395d37d655f45d8a3fc56d9431ce5b80f03dacd35bc5b65498", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224325, "uuid": "9e7e38c5-4c50-4635-b4b1-9d8d180fda97", "value": "T1F95533E61F2D549EA41D9CEC1FC32D2445F4804A84264F84D35B6B0A6FADFCBF0ABA15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224325, "uuid": "f9812970-7f74-4842-904f-6e217e1c50a9", "value": "24576:StcYEtGAlRe2UgDMazgmrF8eAa7i6jX3xKDU+Fx8C3dNHLsQ4CVX4E:qEUAneuMaUm3pjX3oDU+FeCzHLsQ4uIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224325, "uuid": "47638d55-e614-4509-91f3-9db55dd5344c", "value": 1340664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224325, "uuid": "a0dcd61d-cd99-461d-98ae-8d35b284c344", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224325, "uuid": "027aaffc-091a-4506-ac57-859f975410cf", "value": "ecryptfsd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d03bb6-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785211057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211057, "uuid": "0a0c1e15-a937-415a-807a-937e1a5320f0", "comment": "Malware payload", "value": "09a13bfd31a553ff0d2a77be2cdedf4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211057, "uuid": "dac4a810-30ec-4a75-89dd-24122905f4af", "comment": "Malware payload", "value": "b952fbb394b98db1ec918ff2a1a9bda241b9d250a1a0578f8a915d3c2bddc5fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211057, "uuid": "aa0ddddb-f6d8-4953-a247-1045ed68f0c0", "comment": "Malware payload", "value": "4ca21126ba4e9d249dcf598cd0bd3f43ff973ed2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211057, "uuid": "591d07f4-00c2-44ad-97e9-da0b7e54c5d0", "comment": "Malware payload", "value": "6cb29711379d47de0fa02d48c4fa0383bb2b3af232e92e3a88090e922119081e3a990bd96fef3b5fe351c3686727c69a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211057, "uuid": "798c26e1-5395-48dc-9849-dd0f9a806fd9", "value": "T16FE46B627721DFA2D355C67009F3C7594AE520621AE2409672BCC7287E61B2D2E1FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211057, "uuid": "de63c151-4f34-434f-91c1-0c1372e2c636", "value": "12288:yuGJONc6s4XkGz3pf0akeiOyBdgZgpq96AhgIoFIDp+i:yukV4XkGtMaUdtAKiDph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211057, "uuid": "d3fb17ce-1cd0-4f07-a525-e8235de18edf", "value": 677848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211057, "uuid": "cf130be9-751b-4219-b007-f9cb89f29d92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211057, "uuid": "2ecace2b-069f-4d49-9e74-c8c396739c4d", "value": "test_mips_26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe12295-8a9b-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1785253743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785253743, "uuid": "4160be02-ef66-41cd-99ed-66011c19ebe0", "comment": "Malware payload (MassLogger)", "value": "21fdc6622a70685f26ca1b9166899f11", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785253743, "uuid": "41c80691-ae70-4b33-99dc-4bae49cd1ad0", "comment": "Malware payload (MassLogger)", "value": "b95961f75e4c264e5178c6a0ecb1fbca91e2e07a0cb71b3ac634b2a101d5a8f4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785253743, "uuid": "9abae8e2-551d-4823-94db-91c47b3a3ecf", "comment": "Malware payload (MassLogger)", "value": "f1f58699172e6e36f35b2c028e54f33d0389e951", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785253743, "uuid": "35d339cf-3d02-4662-973b-bde48507b4d5", "comment": "Malware payload (MassLogger)", "value": "30d655ab316e0577b404a37a32d24909a4386b0ca9881d23681421a9c066e17e12d00d8e01fd0bbf10988c2fbdd12322", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785253743, "uuid": "8884456e-ff9c-4517-a289-35282a070728", "value": "T1BF26FF7ECDE8413B81BBD529CA8B860BF95E4867331DFD0A64D373C250662C2BCA651D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785253743, "uuid": "736ae5ee-9627-4fb9-897d-e8078c4c9296", "value": "3072:aZBouRyOW5hilgw8h7djk5vADwb4RanXzz1Q1lmSAWwfVzPbU379oriWR8qhIwEL:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785253743, "uuid": "aa749f7c-ace9-4d00-90f8-c7453f77e461", "value": 4607058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785253743, "uuid": "458c81fc-595a-42a5-80a0-4394360a941d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785253743, "uuid": "cf051571-ee7f-4f9d-a02e-627bbdbeb7ea", "value": "Comprobante de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e63094-8aa3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785257112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785257112, "uuid": "555ccd4e-9883-43e5-9145-2b1c23fee3dc", "comment": "Malware payload", "value": "d3a1332d6d9c39f3c659dfe1188b1da4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785257112, "uuid": "6c33f23d-aa45-4556-a334-e0df6991cd97", "comment": "Malware payload", "value": "ba2166fb314b7d27357356fddce6336866514f4def188679eff998202fb18026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785257112, "uuid": "b7bd07d5-dbb7-42eb-9c21-f72ce4ae2e77", "comment": "Malware payload", "value": "b26a27efa0fb16d82c2d0a912ca4320687661597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785257112, "uuid": "3601e2e9-f88c-4fa5-a28d-eedd10b7330c", "comment": "Malware payload", "value": "2f0cb6d93ae25953ba069639103dacbc71dd51d82998d84301ea40c0d90111008cfff637c1aa9081b9a7fdabf4dac97c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785257112, "uuid": "6406fdea-dc72-437d-aa95-f26ef5663897", "value": "T111C622EA27A482B0D0925630758AC3A27581FD4D81FD4E1B3DD72D036F1CCDA694ABF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785257112, "uuid": "48d51d45-484f-461e-b060-134f137e0399", "value": "4808c774a4e178ef87cedde99a265fd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785257112, "uuid": "580813a1-5735-42ba-a054-73b51b1ad001", "value": "196608:9NnmSG1sqxBRYNMq3uVC+uS0vla5rULh2qG5DFrS28cdcyLmj+fLZx:9N8sqxByNMXV+vv/YqGtZS4vLPLZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785257112, "uuid": "cbf005e8-ea91-44bb-8267-add754c0ddcd", "value": 12046512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785257112, "uuid": "a88a6d52-259e-4318-9cbf-ea43ed33f22d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785257112, "uuid": "c0d780c7-cc72-49cb-a409-7605bf6470bb", "value": "Cs2Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67da6c68-8a4e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220477, "uuid": "addd9fbc-80bc-4ee2-826a-67c3fbaf8881", "comment": "Malware payload", "value": "03a84b40d450d74cc857dca944b5aed9", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220477, "uuid": "ff120ebd-02ef-4fdb-a8c2-a8311eb4c60c", "comment": "Malware payload", "value": "ba4ab55a72dd9efb81b913dcfc2e1c70f9b65c01c10ec2099c07102fca2f51ea", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220477, "uuid": "a6912cd3-50c6-41fa-9cc5-35b76a727867", "comment": "Malware payload", "value": "e4de204053181ba34fcbe9d9536222b02e322250", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220477, "uuid": "a52a562a-469a-469e-afca-07628d2596d3", "comment": "Malware payload", "value": "785891c0769ac44c0b480418af7208803f37324360a53b9d1d13406a0b90151fbbe7a2b0cbe42042cc4db94bc5554013", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220477, "uuid": "63a306ed-60e5-44a9-87ee-da4cd7f3176d", "value": "T1DAD423047CAD98A98E0C007B99BA7FAB5AD48EA9044E78C7F9B710B3B3197475758C31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220477, "uuid": "cc481e88-22b6-43dd-a547-0ebe4829d858", "value": "12288:0hmmoBqL9CWNxtQIlli4javJsMzr/ZSXkNMVNS:fc9CkD+hzrRBM3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220477, "uuid": "8e48b059-c217-438f-8cdc-60e77e6775e6", "value": 600096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220477, "uuid": "fa44b2ce-3288-4a43-a570-3bde0b740c61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220477, "uuid": "328ca0a9-88e3-4dd0-9ca9-7f841511c30d", "value": "reservphotoinstaynow.shop.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6a9b8a-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249714, "uuid": "2c432c50-04c4-4596-8e72-60465a3e4688", "comment": "Malware payload (Mirai)", "value": "94dcaf7b140eb327d5292913ab40349c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249714, "uuid": "1ddde7f4-df00-4aad-be59-e218eaaec223", "comment": "Malware payload (Mirai)", "value": "ba9d6c883717a49994af88976053ef1cfc4051f8785cd68f79ba92b1f5b312bd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249714, "uuid": "0f00c02e-2184-48ed-9569-8cc50e6f0748", "comment": "Malware payload (Mirai)", "value": "c4e7588a68b228362afb805aad4bbea774523bd1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249714, "uuid": "8c328b52-08b0-4476-b898-f2be4c7e8bb1", "comment": "Malware payload (Mirai)", "value": "202bf7db7e9cf2a0fc92b26ee74d82745fd801563b6b2bf99dcca416b600a01ab6c0f2595eb5f51defc8a51f5bc314da", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249714, "uuid": "44b32e59-d3fc-4ca4-8aad-f532f6e52aca", "value": "T1BBE36C22CCB15EACE136FD3570398EBA1713A488855B6EBE282783715157DC8F446FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249714, "uuid": "13e8591f-d7a9-45c2-9568-b37d6abe220e", "value": "3072:GjlmYJkJkSkIk+NWuJ6m+lyEWDwsSsgTcx9u:GjlmYJkJkSkIk+QuJ6hydDwZXTcx9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249714, "uuid": "eeb684b8-4945-40b3-94ac-9a44f578584c", "value": 151872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249714, "uuid": "da92f8c7-0b61-486d-8703-82ebf1ab5c16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249714, "uuid": "12bd72ec-cf1a-417c-9868-945c58ef2d5c", "value": "zero.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d511ba6a-8a7a-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785239559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239559, "uuid": "648b07f1-2937-411c-ac53-b7da4a41d967", "comment": "Malware payload (RemusStealer)", "value": "16c8dfdb6a5528d9d937a7ac643816f6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239559, "uuid": "83260ed8-b037-4f74-a261-68b63c91cc6f", "comment": "Malware payload (RemusStealer)", "value": "baf71232724f96eeac468eb71dba5e5af62cebdac9a3aa181ce234d8bdb2a748", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239559, "uuid": "5671cc7f-c76e-4d98-826c-52244460d405", "comment": "Malware payload (RemusStealer)", "value": "2e0f4caa6ad5bb8322209054e51f6c1892c18af0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239559, "uuid": "4ea9dfde-effc-4b2e-b591-425ab330f4e1", "comment": "Malware payload (RemusStealer)", "value": "c9da0e39c09aa8d9c564c065d591c6e865cde859fe7967544437ed5c3c670388b6c578bd5d3c8a862c4ed98990d1bd49", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239559, "uuid": "3c184c3c-9c53-4b7c-bf11-cc222065ba48", "value": "T17DD55A07FCD158F6C09AA33589A256527B75BC482B3223DB2EA0B7782F727D09D35718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239559, "uuid": "08bca129-2631-47ff-b00f-116e85ea4891", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239559, "uuid": "521396b7-47af-41dd-9833-617c3d576b13", "value": "24576:t96BwOLxI9OMF5Lsc/DDZv8q30dxnBu0KY8no2yd6qYbG+FoBeletI9DOi0OGKPr:t96te9dRP/DD73WxBlKS2nJzkgz+c5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785239559, "uuid": "df865efa-4e75-4626-b220-8bfa37f6f36e", "value": 2946400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785239559, "uuid": "0bd454f8-ed4c-4a21-bbbb-7fb8b7b60d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239559, "uuid": "dba18a6d-1d3f-4e71-a3bc-c5af502e13a3", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75de4adf-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220930, "uuid": "2668c3ad-cb9e-4f87-bd8f-9da286dc94c6", "comment": "Malware payload", "value": "4de57916efddb0c3092604dfd1e81017", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220930, "uuid": "07b0dc42-c33b-41c7-92c8-5d34c682fcfb", "comment": "Malware payload", "value": "bb78c721cb7d05c5186df16597cd3da15d2927c337efa68dc1acf23ee716eb9f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220930, "uuid": "26eb7d55-84cd-4d44-b2b1-c36980ca21b9", "comment": "Malware payload", "value": "b3790e375fb04da8600c9bc9cc287a1d2ac6187f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220930, "uuid": "fbc93947-f128-4659-b961-eaabae6ad174", "comment": "Malware payload", "value": "6b619d3eaba35b0fa7d10c12bc575ff2e5bd373ca3f2fc36d4e794f3b58c2f01cdf6d287d528cae56312637d691f1697", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220930, "uuid": "601c683f-ff36-4a8c-8208-371ea13c698d", "value": "T13962C0A187CD82B3FCD812F41B922CBB27B1174D1367B04AE262618F7A09947B635D09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220930, "uuid": "bd821e1f-9f38-483c-bcec-59cb01d7ef20", "value": "384:4nFEzfLjRMDbriNru+ijInxdv8VUaTDqJ3EIMEPBlx:4FoLjRMuqIxWVHvq00Blx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220930, "uuid": "e37ed32e-a15e-41a2-bc6b-98d42028f843", "value": 15680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220930, "uuid": "68400c0c-f33f-497c-a708-c82084ef5a66", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220930, "uuid": "5d5f7673-5900-4c9c-b340-f28f93545065", "value": "images_20260727_103604.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada67102-8a49-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785218447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218447, "uuid": "76340fe1-1735-4803-a9c9-f5d8a175738f", "comment": "Malware payload", "value": "d80fe417d1138d8b1c429da560fbfe45", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218447, "uuid": "8b1009de-726f-4675-9167-e5b302fb4809", "comment": "Malware payload", "value": "bc26b8ce7bf8920c977b60de951c88d118116226756f1ccd4cab12eb39e16995", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218447, "uuid": "39074525-c4ab-4aa2-b966-f9a7d08aa350", "comment": "Malware payload", "value": "08cf9892dd8d9e6f9b0dd89f822e72cf552e69d5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218447, "uuid": "131b625d-b2bf-407b-99d2-3ce63a079a2c", "comment": "Malware payload", "value": "4b437cf83218239c1cf1b82088e52ab7e89baae6f44919463f8fc3aa0e39b5f4d26e4731832b5c59d23452b834bf1521", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785218447, "uuid": "da299dba-d7ca-4a76-9033-7e1b46cd8fe4", "value": "T1A1C27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785218447, "uuid": "3935acb9-7f2f-4a4f-9a0d-45712ff9fdd0", "value": "768:xS8vCB+25j6es8RGp9FYpMSUpi+20qUpi+20YQX:xS8l25Jgd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785218447, "uuid": "4ca44e4f-3506-40c5-a37c-bd4e701a6e40", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785218447, "uuid": "105bcc24-6b47-4e4d-928a-126cd2cf026f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785218447, "uuid": "4e9cba6b-c1b4-47e1-a9dd-133029129a8c", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e983c985-8a99-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785252907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252907, "uuid": "96a97415-cccd-48ab-a5ae-329179cd570b", "comment": "Malware payload", "value": "65c806141bfd198e3cb6f089c2ea76db", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252907, "uuid": "98fb7f2b-1b76-456a-8277-b79a265429de", "comment": "Malware payload", "value": "bc8b5a85db02c23d53d99807b67f13c70f754a595666ab41281779c9f2dd960f", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252907, "uuid": "62c5a57a-be2a-46d2-bdab-fcc0c8d42a3b", "comment": "Malware payload", "value": "2231dfb05e5e3ad06aa358ec7f8e64b577d9cde4", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252907, "uuid": "68aabdb7-a70f-4ffc-ac48-68e81a000ebd", "comment": "Malware payload", "value": "f4a8807f31ed2d3f8113b2b1edfa706e10b8543ab41c9a5d692a8572bbf97877d8b0d4703c1e908828570f7a4aa6f179", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252907, "uuid": "f71cbbcc-9d74-431d-80a9-d1e5c0c0832e", "value": "T114833A41398FA979A372626193B7980DCD9DC07281014295BCDD356ABFB4018F7EFCAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252907, "uuid": "d086718e-f6cb-40e6-8100-f1851fa1118d", "value": "1536:J0qDwxlR6hR0RtkF+kFTw18Rn/sqa0liggIzVFxL5UsvXmRUL/vO:J0qkxgoKPfhfx668", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785252907, "uuid": "0514882f-3623-43f4-9643-f2687bd7adda", "value": 82951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785252907, "uuid": "22d474de-d620-463e-9909-1cadcc976902", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252907, "uuid": "18094683-1b58-48f1-857b-d026ef59e024", "value": "index.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a03a05e-8a8b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785246761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246761, "uuid": "f1f1dd69-2cd8-479c-9d89-db59ceb29e79", "comment": "Malware payload", "value": "a9c0d21974a358fa93925fc178908c83", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246761, "uuid": "ad0e645e-2614-4f27-8283-ce9c87d962df", "comment": "Malware payload", "value": "bcbcf9736cec3cc0e1941dd882bf77a89494817ddd1f7d38a8edbbc11429d200", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246761, "uuid": "bc9cdac6-0194-4687-b94c-3baf701b308f", "comment": "Malware payload", "value": "164f81ca1d0d4228754b63245ad27eb043443996", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246761, "uuid": "b806a1b6-a03d-41d5-9efb-3f0d34e809b7", "comment": "Malware payload", "value": "3606cd69dee2d40b7ce3f16155b6df3b181b4745edb2f2f460327917c2f0f337a00b2b6f6bd231bf720462373eb673ce", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246761, "uuid": "6afe3bc4-7a46-4604-85c1-4e80b9036103", "value": "T120C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246761, "uuid": "9afc7b91-5d1e-49f4-bd9f-d0de6f5e9894", "value": "768:h8vCB+25j6es8RP9FYpMSUpi+20qUpi+20YQX:h8l25JZd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785246761, "uuid": "6071b40b-780c-4592-8a83-a5272001cbe4", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785246761, "uuid": "c180fa85-4246-4270-b556-9e88cc276250", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246761, "uuid": "f87c2129-bc7b-4f29-90cf-897ec92c432a", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15543fed-8a1c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785198864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198864, "uuid": "09c93382-0e2b-4bd3-a16f-7f35c9c4dd4d", "comment": "Malware payload", "value": "0e184229dca0361a5a1adc56963f071c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198864, "uuid": "d9d0e90e-e84b-41d2-b6a6-61a5e8cc5727", "comment": "Malware payload", "value": "bd5cabe39fddca6f03728e5a86e791acb14438adb6e6ad8fca4d80f9d7ea802a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198864, "uuid": "0e8e51d2-e258-422a-95a6-fd26fec397e7", "comment": "Malware payload", "value": "f6a3c80bcbd19c4fd13767040e77b0a2dbd5d746", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198864, "uuid": "aaec2e22-9177-4068-9178-6201e4c8e455", "comment": "Malware payload", "value": "6759b7b5a39e5cf702894a70798f695e2901a3f6d2211f31d2b5f14a9289b75dd712112d9bfe15a6034ebf5e9580f6d9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198864, "uuid": "1c8d2990-3a08-4f38-963a-3c530ed90af3", "value": "T1E2C27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D4A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198864, "uuid": "fe54a71b-a5d2-4967-821c-f08d8766a291", "value": "768:M8vCB+25j6es8RBZ9FYpMSUpi+20qUpi+20YQX:M8l25JB/d2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785198864, "uuid": "ec9c6cd7-648b-43fc-9f2a-a35e9a2ad307", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785198864, "uuid": "d82a19eb-b550-476f-a0a7-1b8431fd14d3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198864, "uuid": "8479ec98-aec1-4906-946e-5f53ab74dcab", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db68787d-8ac0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785269634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269634, "uuid": "08504a1a-46c1-42e3-be1e-a9d174b4dd89", "comment": "Malware payload (Mirai)", "value": "7931fe21f24ec88d27bb4037cdd423b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269634, "uuid": "5c7bb53f-59e8-46c1-a631-fa6a5b9706f9", "comment": "Malware payload (Mirai)", "value": "beeb2032f9a69f24e399a12568a2bbc5d184bb5461264e9ce7abf1298f77d003", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269634, "uuid": "6965f800-a2b3-4ea4-9b1a-c30f9e7bdb91", "comment": "Malware payload (Mirai)", "value": "a40bc12cf0af76b69866b27d9ba421a6aa4e3745", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269634, "uuid": "eed96564-7ffd-40f6-976f-5dc5cb42b486", "comment": "Malware payload (Mirai)", "value": "8433ddaf966f6b3f3e1e8b2835136b7edfea733ec2c905c20b65618c2c4ff5dfde4b4f4c5bfae0700cf94b38b14d6fb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785269634, "uuid": "cbf0d76e-2c56-4264-9ccc-704b72f06f93", "value": "T150A35E9BF401EE7DF80BD5BA04674A0AF630E3E11B930B366397BD57ED351A50826E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785269634, "uuid": "683e2ef7-0faf-42d2-b8a0-64fe11490f0e", "value": "1536:iPhR5NUppD0SKDTh7BN8H9/oRLfZAufjW1t0NPtwCkw8:ipqfoS+7BsKLhzvNPtwCkw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785269634, "uuid": "c5821618-e103-48d7-ad9d-9483ea5fa1d9", "value": 106760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785269634, "uuid": "2d272f0d-2c1e-4d70-89fc-d46f110aabbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785269634, "uuid": "40a4ca14-9ecf-4ef4-8bc5-c958841d0295", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c5e7b0-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785245995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245995, "uuid": "ce33c917-8129-4755-b023-6ea6b763963b", "comment": "Malware payload (PureLogsStealer)", "value": "fade4ddee4d208ee729f8e60bced18d0", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245995, "uuid": "ae26d8f6-536b-4bc7-ab9a-591098153854", "comment": "Malware payload (PureLogsStealer)", "value": "bf06a13c596956a93116bbacd4a0a9ce9c8333d58b4d6abdd2286303d80e3079", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245995, "uuid": "0eab7719-49ca-47d0-a8be-d2c71db1b2c2", "comment": "Malware payload (PureLogsStealer)", "value": "66d8b7f64862fd55627966af13d1a25afcf9ee7e", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245995, "uuid": "c59ab5e4-603f-4422-97f9-c743f4acad5a", "comment": "Malware payload (PureLogsStealer)", "value": "3d08399e9814b0dc3036046587c88b7522b57398310306af0dd0b711c93e8c07a7eaf2b02f9bdf343ef8bade85912922", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245995, "uuid": "3f58bc2e-909e-4e5b-81dc-0acd7838e7dc", "value": "T1FD96AD16F7A845E5C076D13896529236E2B278628B3193CB16EAC72E1F37BD15F3E700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245995, "uuid": "b67c4f0d-be36-4cbe-ac01-296b5a9e31d7", "value": "196608:2/4FPQts59wddUL9OEznRvtArFkL+Qb6JRlUM/0rNPBk8CdR:2/qPQtscq9OcRwknaRz0xPu82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245995, "uuid": "9dd1e8b1-8148-42e2-b725-6b287cb4ad25", "value": 9091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245995, "uuid": "3e09f73e-51b0-41da-96ae-83294d679842", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245995, "uuid": "7afb6cdd-edf8-4022-9ea9-e3fdace82ac6", "value": "bf06a13c596956a93116bbacd4a0a9ce9c8333d58b4d6abdd2286303d80e3079.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02307dbc-8a50-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221166, "uuid": "ecc0e793-9510-4629-bee3-a722f9b43457", "comment": "Malware payload", "value": "b64e8416d5f4024f860ad215daca6443", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221166, "uuid": "a8391312-2aa0-4b6c-b9ed-5edf7161414e", "comment": "Malware payload", "value": "c075fcb63edf1f4e36fdd50a84811f348192a8840170565572c48f428c19fd71", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221166, "uuid": "c53aa0d2-96b2-4121-8d10-5464b175884f", "comment": "Malware payload", "value": "02d21b3e8901623475c7989010bdd7fd5524aa37", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221166, "uuid": "23c7ceec-5bab-46f1-b479-95944c1190e2", "comment": "Malware payload", "value": "3c50a6c9889bb59fe466a1538a4ec611aac056ac408820614819bca4f3a7d3ce79ce0d4eda265db2b20da9ef49f84177", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221166, "uuid": "6cc7ab82-de28-415c-9a91-51bd6112904e", "value": "T186514C955E8389A0C79C0373517E9EFD735C57012106BB9A384997AEA01E690E508B76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221166, "uuid": "d6bd0992-83aa-412c-950a-7e7184268f66", "value": "48:9A02n0Arz/Ql0YE/ynJPyIS+gPY52Fmq43/q8XRJBl2kJV4MxKEnKY3pkp6JSrmE:vM4l0/IS++FJ43/q8XRJBl2kJmMXKrYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221166, "uuid": "f3bf491f-e9a8-484f-8f1e-88e00d034a0a", "value": 3055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221166, "uuid": "e4ea51f5-009c-48c0-9da2-d27ca5c76ea7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221166, "uuid": "c058981c-6170-4bd0-bf5e-f2abc3e5ec5d", "value": "images_20260727_192427.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f14350-8a74-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785236765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236765, "uuid": "269d167d-d588-4e01-8d79-d5d506ecf6ac", "comment": "Malware payload (Mirai)", "value": "7d0536daa8ee8c8bd4248d9ce167d478", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236765, "uuid": "580836f0-736a-46b6-9c76-0898d5c7ab75", "comment": "Malware payload (Mirai)", "value": "c09963ec359572464c7c33afd9dfc332e0aa9f9bd488ec61392860d7cd1153c2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236765, "uuid": "9b412ffe-c70d-41fb-b8d9-8b86afbccf92", "comment": "Malware payload (Mirai)", "value": "d880c7b0b7804af7a636d814866c94f30f3e1a7a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236765, "uuid": "cee92833-2139-431e-869e-55e453be5c36", "comment": "Malware payload (Mirai)", "value": "ccc7afc5432463da0f619856072131dd8b065296031516ce43ad7a3e1261359473af8b66eb2b17a4095375a8350c4c15", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236765, "uuid": "aa60fed7-b7f2-4352-b47c-91d602f94db7", "value": "T1A6A14DB5E65DAC76758E853CB3597224484204670BF17BF8F18EAB302F2E239B16C725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236765, "uuid": "0fe41acf-1351-4054-ac4f-9902b09c4dc1", "value": "96:17N9yhkL/8boMTw/qZs5RB7uB7IB6BkBtBiB8BEBYB8B5HJBl2BVBhfBvB7mCGFE:BzqiTdudIIKroGimGbJWfvxdmC2ZsrsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785236765, "uuid": "4b16e71e-18a5-4ca3-9824-4a7c02fd677b", "value": 4835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785236765, "uuid": "2aae58a5-c0c5-448d-9dee-316bca621a3e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236765, "uuid": "bd9cfa04-ebc9-449c-ac35-a99254dbe614", "value": "c09963ec359572464c7c33afd9dfc332e0aa9f9bd488ec61392860d7cd1153c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd4afb3-8a47-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785217458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217458, "uuid": "34db0805-c2ee-41ce-aa7b-5014a1d09b38", "comment": "Malware payload", "value": "f134b162d7f566e4841fddac39995da5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217458, "uuid": "12164e22-204a-4c2a-a757-ef747e9aa36b", "comment": "Malware payload", "value": "c11ee1171bb97d0fe11d880aa65aadda5221fd5cf98cfcbc6e27cd9213bb9716", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217458, "uuid": "b02420a5-35a8-41c0-96fe-0cba928e4580", "comment": "Malware payload", "value": "87b3bb78c499fae615e01942c36227a6a2680a09", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785217458, "uuid": "80044766-d980-4a13-a9aa-21667119a37d", "comment": "Malware payload", "value": "584f02b73c3098d0bc88c3f81840020ee069e67e21ff2bc0e287c62613111d472f8d26c7120d43892fa186ec48cf6e1f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217458, "uuid": "c0ecadf2-2250-43da-9c47-83c7f90fa91e", "value": "T1FAC28D966A867C44BEC94A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C15FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217458, "uuid": "95c7c0e2-7171-40d2-8d1d-da7c3909997e", "value": "768:CS8vCB+25j6es8RE9FYpMSUpi+20qUpi+20YQX:CS8l25Jid2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785217458, "uuid": "07f397a8-440a-43c7-ac84-0b5de00ab1da", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785217458, "uuid": "64792665-15d3-4a27-97e7-d3cd9c965d2a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785217458, "uuid": "ac52da11-1f52-45d7-a64f-f76efff7a761", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731f8862-8a58-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785224791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224791, "uuid": "8209d038-5ac6-4513-bb40-2f054fcecce4", "comment": "Malware payload (Formbook)", "value": "a560021ea970572d26d453d3d02ccb25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224791, "uuid": "777cc5c7-dae7-4c06-9249-a11dd2efd039", "comment": "Malware payload (Formbook)", "value": "c189e889e530d891501d459eea14af09e51af8f489cfb827cca985af057f2276", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224791, "uuid": "1db7051c-d460-4eb0-94b9-200ba4637952", "comment": "Malware payload (Formbook)", "value": "9bdbcc272e653262327d4f865782b99c1e35c5d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224791, "uuid": "ef34b238-9242-4628-b33f-671bdd54b093", "comment": "Malware payload (Formbook)", "value": "f75c1011c8e359f9d54a421af572b42842661474a19fda70c0c6a9562a19e42c8b41165f94767e0525cf52c7f0f283c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224791, "uuid": "5af093d0-3c8f-4bc0-a52e-cdbb5265c340", "value": "T1112522147B98D602F5EB67B45638E4315BB13DDAEB30C90A4FEAACDB3465B048D10B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224791, "uuid": "0e02aabb-3fde-46f3-806f-39e575c82dba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224791, "uuid": "3ee6ae2a-4e8b-40a6-afa5-0ee7d2681b90", "value": "12288:E5qSpvuOEtAHA5QFcD6jHbgR+a25sCojSxv0njVtO42cujcxiq3gyCp9/JlOVaEV:EtpJkQOC7gR+aMrvITO1jkXwZ9/KHEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224791, "uuid": "c6547980-5c82-46ed-8cef-bb4f41007b23", "value": 1038336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224791, "uuid": "22d000a0-1299-4667-b167-bd293faad3c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224791, "uuid": "caba8e4b-69cd-47e8-9406-076132aac921", "value": "PO_62401394.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e94aaf-8a88-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785245363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245363, "uuid": "293635e6-b1b5-456a-ba29-a4102a7fed5a", "comment": "Malware payload (CoinMiner)", "value": "c9d0dafd346d0654623b72b7039ab63a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245363, "uuid": "e74931ef-7082-4ea0-9c2c-f29ebb52c9eb", "comment": "Malware payload (CoinMiner)", "value": "c1996d4fe6c679462269511c38184b50b89ff7f05a3c3055b1cf8f686d2b03c4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245363, "uuid": "d0f6f067-5b67-482c-a95d-190cf67273b3", "comment": "Malware payload (CoinMiner)", "value": "cb8c40bf3e2a3ce26726d6baa0f28c03775f8ba3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245363, "uuid": "d8ce860e-cbd5-4f99-b0c4-68a49bdabda9", "comment": "Malware payload (CoinMiner)", "value": "c379af4d649fd27d1e7917a2320970d95c8fbe46204464d402c2667a1ebc6c1a0d4d856774032963de317b57f888ef27", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245363, "uuid": "98e2e85c-47a0-4fd6-860c-36e3ce9cde34", "value": "T1EA32921D6E4B0322EE5144B4E475424A543D1EE3B743EBDBE633D1DB4AC6E8488C1A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245363, "uuid": "3e0b0480-c188-4e64-8325-fd47e50ca098", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245363, "uuid": "b958025d-2e1b-420b-b5bd-f02c23b92492", "value": "192:6oFeJIS5BHHxSHO8H5epPFJxTEZmFhqm:6ogJDHsueepPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245363, "uuid": "123cec3e-fb58-460d-9bcc-bdc5a0dfe888", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245363, "uuid": "95c1efd5-0014-49ed-8d7b-cfe6f96ee381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245363, "uuid": "9945822f-60ef-4ee5-b71d-980150e2b221", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2d4525-8ab3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785263971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785263971, "uuid": "c546450a-2a2f-42a1-8d02-2b08a837bf42", "comment": "Malware payload (Mirai)", "value": "61bc180ce970b2604676a24b9ecc0595", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785263971, "uuid": "99a5e62c-7a61-4101-8d8a-b0682f74279b", "comment": "Malware payload (Mirai)", "value": "c21959d86c4bc6dbb47a02fb397f1180b5cfc1ca40519d708f1cbef5561faa3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785263971, "uuid": "cf13bbd6-5ddc-49ff-ac88-1cc53eda1162", "comment": "Malware payload (Mirai)", "value": "1ee8052a83c574079b2210e63c52b295f611a25e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785263971, "uuid": "b46138ab-8b41-4d1f-aa8f-c90b146b545b", "comment": "Malware payload (Mirai)", "value": "5d6e2292eeb94111266b02e26a5f2fac05a60792d361c8b16bb9f23e19c601b6e31f3a5f377db24d51052f7ce5af7e95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785263971, "uuid": "fd8a41ef-524b-41f6-950f-e663bf4dbc08", "value": "T1BFA3F65AF9819B11D4D525BEFE0F818D33235BACE3EF7212AD145B2537CA92B0E7A101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785263971, "uuid": "35e67311-5f1a-4a36-b7f2-208bd209e150", "value": "3072:rnMfSQ+uEsoLsDRGYNlaseSN/UoCffwdvSaMkLPenboQ:rnMfz+JLsNG2laseSN/VCHwEaM0PioQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785263971, "uuid": "cc60d0ae-28bd-449d-9f96-8c344e3adc83", "value": 105128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785263971, "uuid": "3213fce1-4ca8-4a62-b049-337b06b85518", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785263971, "uuid": "8523ce89-7a94-43ff-87e8-09212aa6909c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f842174a-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221149, "uuid": "8131d5fe-12db-47be-8d02-2632e779acc7", "comment": "Malware payload", "value": "c4f6a769ef0267d5e319a9ad929085b3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221149, "uuid": "16286e14-8cbd-4a60-b858-a69221224545", "comment": "Malware payload", "value": "c2f980609eddd00c7f0de89bde406e9849b6294d2e4b618d7cc20256b233853c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221149, "uuid": "38234757-43b7-4571-a823-0b8052bdc943", "comment": "Malware payload", "value": "78a73568a38cec78c2b613df369a670e0d9dcee7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221149, "uuid": "de0095b3-b29e-44c1-b226-4956738cf46e", "comment": "Malware payload", "value": "e12b16aa6404595ca423a56a6a27c417d1ac7df2702b111f1e7da8f46b1ff7920603127dade44f47e10625d8622ba4e1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221149, "uuid": "f6f857a5-7098-4aee-8ad5-9b763e795d43", "value": "T1B572E113F3C24863ED4C6CA781366BE36AD2DB0FE4927F91ACA8F1CD1112409589782F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221149, "uuid": "c0547745-e692-45bd-bb17-8aa445530bd8", "value": "384:kkeybMIPtGO81FBomQpOxIMSdgQMsNNkW4sUzpFdC:5MoGO81FBoeLhQvNByF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221149, "uuid": "e08f976a-0dd0-4d17-a7da-58220b22353c", "value": 16705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221149, "uuid": "7d740eff-e4b1-4563-bc36-3c91ae10872e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221149, "uuid": "7e88de8e-e2f2-4e64-b2b8-9071ed9fea3b", "value": "images_20260727_191615.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995c5efa-8a8a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785246330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246330, "uuid": "c7bc4e14-e258-481b-a8ba-38a37d673ce8", "comment": "Malware payload", "value": "3087c8d2f911bfb2b52ff9c8fa251d62", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246330, "uuid": "31d26049-2c00-4168-8f3b-ff7559965355", "comment": "Malware payload", "value": "c3f0ca1f6cf76241e333eda2446e3c773ad4e8d46a1e27ecc821fab26f152228", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246330, "uuid": "4d291fa9-8f33-4d3c-af65-8e788506cc33", "comment": "Malware payload", "value": "c6e04a60777efa215c913df62bb02b3fa06b7dd4", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246330, "uuid": "e357f0ec-46c7-4053-9df2-790ad667b8fe", "comment": "Malware payload", "value": "05763d815d92113e3657dcbdc98a12b0515921223b5c3c19b62e76e4db289643c64683635288f6dbf29803baafdf0c74", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246330, "uuid": "8025597b-8fcc-4d37-9fc0-f59e16b07b98", "value": "T1EAF5BE96B3C46A9DD01ADE399714F232C1B2B9234F77D1CA5A96C30A1BB6E414F3DB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246330, "uuid": "5deccf42-ebe6-4b70-b452-bba08b7ecc68", "value": "c9d6ab13d943908634413d42c642c931", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246330, "uuid": "ae4aa21b-a60a-488e-871b-190159ec64a2", "value": "98304:7pBbq0qn6t0J4fngLHf/RFYwHmbUUPO3biSf4XIeAVIAGdXtvAfTi5xvZF7AG9rK:7rWzn6Ag271HGUUPO3bpfnVfGJZaItXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785246330, "uuid": "b74ead82-dd3a-4c13-b99b-08fbfbdce6ad", "value": 3563520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785246330, "uuid": "795fa5a2-cf2d-447f-ae67-5378df8e9e89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246330, "uuid": "e13468c8-a9cc-4448-abad-33f10002def3", "value": "POWRPROF.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf17b1c-8a4e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220676, "uuid": "1323a04f-4d5a-42ce-bb7a-4692d3afaea8", "comment": "Malware payload", "value": "ca7fe41350f1efc81a57fb97724806c9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220676, "uuid": "3a1ff51c-cdd0-4047-9cff-ef8c6a0790ba", "comment": "Malware payload", "value": "c41239e2d1f15682156211a36ee0d9936842f1311d167e6ec29a05b5578d3f6a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220676, "uuid": "ff354d1a-52d2-4193-8e18-aa56c2421c39", "comment": "Malware payload", "value": "ce1bb40da39ad0e6884c68de77dffb52baa0717d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220676, "uuid": "0c62a5c7-9e19-4253-9f71-1c30fa09d931", "comment": "Malware payload", "value": "b103c445a8c173345f691bc4e3fe1e1ab8b144e678f1df0c657a4b7a7180423bdba736a3b3af2869c6fb12ec892e58f4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220676, "uuid": "4d530747-5ce1-4d13-87bc-e00d5c5c54da", "value": "T1BAF1AEC86037AAAAEDC02277C3F36C5E950C326E1ECA57173D996B0290AD44786697C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220676, "uuid": "af5dba84-d61c-4d83-bf67-9c3c60b35407", "value": "96:tdzKzN0CUkqt3JGPDjjKfqbkXroEgv9s1RBcgoW4giXn4ZcxWXkleJ5YUhKHgdrm:tk/SoPXjuqbfEglC6P4GkklbUoAxut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220676, "uuid": "51c7a4dd-4beb-44a7-8491-6712b6bc8fbc", "value": 7663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220676, "uuid": "4f9c652d-16fa-4f89-9f2f-2fa182984aad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220676, "uuid": "e4f5d8c4-e3d7-4ca8-91e8-fc0e47a0429d", "value": "images_20260727_080639.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61715a11-8aab-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785260410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785260410, "uuid": "8ac00290-d0e0-469b-9a52-554ade481465", "comment": "Malware payload", "value": "61bc24eb262a610a7ecd6de8394d2f2f", "object_relation": "md5", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "fileless", "colour": "#FBF92B", "exportable": true, "hide_tag": false }, { "name": "kill-rivals", "colour": "#80CF92", "exportable": true, "hide_tag": false }, { "name": "postgresql", "colour": "#A47ECC", "exportable": true, "hide_tag": false }, { "name": "rediserver", "colour": "#D3FCA3", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785260410, "uuid": "fb784186-4457-4f4f-8dae-e111810750ad", "comment": "Malware payload", "value": "c7b5d9d4b4084a9f7895620d1e5cde847d97c307208656624eda728d4191cccc", "object_relation": "sha256", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "fileless", "colour": "#FBF92B", "exportable": true, "hide_tag": false }, { "name": "kill-rivals", "colour": "#80CF92", "exportable": true, "hide_tag": false }, { "name": "postgresql", "colour": "#A47ECC", "exportable": true, "hide_tag": false }, { "name": "rediserver", "colour": "#D3FCA3", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785260410, "uuid": "94e2849a-2c01-470e-bb6e-002db4b59b06", "comment": "Malware payload", "value": "4fc818625edd020a760e2a5530a2a71f05e36554", "object_relation": "sha1", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "fileless", "colour": "#FBF92B", "exportable": true, "hide_tag": false }, { "name": "kill-rivals", "colour": "#80CF92", "exportable": true, "hide_tag": false }, { "name": "postgresql", "colour": "#A47ECC", "exportable": true, "hide_tag": false }, { "name": "rediserver", "colour": "#D3FCA3", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785260410, "uuid": "00fbdb84-a241-4374-835b-d4fb130e4e1e", "comment": "Malware payload", "value": "b1e4663226116e51be566286663be44c53377ec11bdb43affe52e101915d4c19ed7f26acffb74b2a3563599c3d7a7cb5", "object_relation": "sha3-384", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "fileless", "colour": "#FBF92B", "exportable": true, "hide_tag": false }, { "name": "kill-rivals", "colour": "#80CF92", "exportable": true, "hide_tag": false }, { "name": "postgresql", "colour": "#A47ECC", "exportable": true, "hide_tag": false }, { "name": "rediserver", "colour": "#D3FCA3", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785260410, "uuid": "6865832a-deae-4bcc-b104-b7ea0edd6703", "value": "T1C531324AE52DAC2E39DC8C60B1D251C09583CB8C56763A28F672FCB56C6C142B22DA68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785260410, "uuid": "3498efff-2b76-4ee1-9182-b162d602c7ad", "value": "48:zipPHn5ZYOgKoH77j4GLtPi0hYtmmZKjEg:zihHDYtkGLtPixtbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785260410, "uuid": "3293c0f3-153a-457a-81c3-aaa0e0c2eb84", "value": 1673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785260410, "uuid": "83503f8d-8683-4ce7-8786-cea590308c2a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785260410, "uuid": "cd211726-2cc8-4395-8117-b9ca834964e0", "value": "c7b5d9d4b4084a9f7895620d1e5cde847d97c307208656624eda728d4191cccc_from_65.49.27.190_pgcopy.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7871be1a-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220935, "uuid": "f53cb5ae-a88c-4355-830e-835e1bf4c817", "comment": "Malware payload", "value": "de991a8658c1ebe7b79d147a95a7995a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220935, "uuid": "3aab8ed2-7b7e-4a93-b15e-7419eb66c2fb", "comment": "Malware payload", "value": "c8169f32c82c71a2216fb081cb9754f0f75071e1ffecd6613b04d67f0657a947", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220935, "uuid": "badf4663-ded7-4f51-967b-0a86f6b4ebe8", "comment": "Malware payload", "value": "8834302fbbe849246388bc25f7c44a00d3f5cc92", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220935, "uuid": "c54f5458-e0e0-4e1f-bbb5-6b809256300e", "comment": "Malware payload", "value": "e0b25e76d19877781e4f78435c4a0c47ca51e10a97978cdeeb25cc8ff44d06f40de18efad6768c7693d7623a4a9d2abc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220935, "uuid": "9fd6ab47-5ff1-4c72-b4f6-12412c73fd77", "value": "T156E1B0DA90918BA0FD7767FCE26B097CB74108113128BA1F90E405BE8BB797288D855F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220935, "uuid": "fa584394-106b-4071-a19c-3b8eb20f4a85", "value": "192:YstUl3CqmSXEFWozWDQQpGjYG6BE0zA87g6:YstUl3C8ej3OYYJK0zA8s6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220935, "uuid": "0d3db4c1-60db-4f16-8adc-8e844fe93eb6", "value": 7313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220935, "uuid": "2725f95c-2588-4a2b-b6f2-2ad3f333819c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220935, "uuid": "2e86e109-2abb-4fe8-ac53-0e50d09e7767", "value": "images_20260727_134003.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78330d03-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249711, "uuid": "1d842365-1e90-4748-8589-45aea4ef2d9e", "comment": "Malware payload (Mirai)", "value": "821424ae0477a2c5b19f3b9f99a9a408", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249711, "uuid": "47970248-056e-4d9e-b5ff-a936dbd7b88a", "comment": "Malware payload (Mirai)", "value": "ca0828978ee1dd49804366aaf75fda5635b32352dac20e0db89ca102589292fd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249711, "uuid": "3ad84831-cac4-4398-b15c-1cfc6c67d031", "comment": "Malware payload (Mirai)", "value": "9956538c0dc4a7fad35dc00e3ec3fafb563d7cdf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249711, "uuid": "45338061-71b6-4d9c-809d-2bf758eb59fc", "comment": "Malware payload (Mirai)", "value": "02a7b15d38a6e5b2d0fbcfc3ba5c2677f23fc000f244dd845a2e1ce7745541d7060e2c6a74e88849c3fe5d1aa499c2c9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249711, "uuid": "4e3f4ab9-2a32-45b6-8216-7de7396ab16a", "value": "T16C430136A61078ACFF65ECBD57E40B91A8711FF0D4A2AD40A92298C371E3C707587D8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249711, "uuid": "be8273b8-0846-4fc4-bd8f-7c89f708ee7b", "value": "1536:SpxmndYiw7OvxJfBrU316dy30pC0ztsQrmNnDHRcTVJuR:q2dYViJfAEdq0pCstsQrmNnDHRcTVQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249711, "uuid": "e2f554ee-28b3-4e9a-b1fe-dc871b931aa4", "value": 59220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249711, "uuid": "583c858c-b4c3-431c-8682-b4b6b17c6931", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249711, "uuid": "4e2aee38-882b-4c5b-91f2-8f5e33b3a5c7", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81d191f-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785246006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246006, "uuid": "e48cda29-9a08-4ad8-b074-6e76682f9ab8", "comment": "Malware payload (PureLogsStealer)", "value": "cc774e2ec0c14b7364570885b3f85751", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246006, "uuid": "f99ac94c-3728-4256-ab8d-87dcca321b92", "comment": "Malware payload (PureLogsStealer)", "value": "ca2c730214744670ea887ec8b305d769537345d23b791e6d7cecd74770672bc3", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246006, "uuid": "fe56728c-ba12-4d19-99a8-e251423e815b", "comment": "Malware payload (PureLogsStealer)", "value": "c03993b713196307e9534f748c49b2b9c4ca4413", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246006, "uuid": "2dae2a79-ad23-433a-a334-6bd158e84448", "comment": "Malware payload (PureLogsStealer)", "value": "d69dcf51fd7f39231e42dcae580f2987df4dd69c3cd5da9f2d8a25225534ae5689f707651798ee9c2fb2df83d41a23d4", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246006, "uuid": "d7fbe8fe-83f3-4c8b-86e0-0c31d643a54e", "value": "T1C2F5DF14E39801A8E967D738CA659333D6B078568334E58F1A9CD3062F77AA19F7F312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246006, "uuid": "6eec6d14-e4bf-4d26-90a4-6ac1a08fb3c0", "value": "49152:+4/dEGTou3/xp1IBTT6Wlckj7Y0s3MZhfvUWp1ts0v:Qyo4XzhkHYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785246006, "uuid": "d3ddc45a-feec-466a-a1c9-fc75b8f28f03", "value": 3452928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785246006, "uuid": "6bb31b42-2999-43f5-89a4-bbffed28482d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246006, "uuid": "3c57589c-5bc8-447d-a914-7f3c34b44a5d", "value": "ca2c730214744670ea887ec8b305d769537345d23b791e6d7cecd74770672bc3.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e78170-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233218, "uuid": "dd098676-9caa-4f9b-8537-fac4942b8ed5", "comment": "Malware payload", "value": "74ee78994688ce04df4b9602abb177d7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233218, "uuid": "076ce4e0-b1b6-47f0-a935-a0db44b989b5", "comment": "Malware payload", "value": "cad616f73b8057efe2d988ec83f8e6cfe5765693db4c6ec924602df25daaaa6d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233218, "uuid": "f5d8e5c0-7415-4f26-8cd8-a4c4ed55adc7", "comment": "Malware payload", "value": "4ab4f8228a4598b2ceebc795035a1ee7616bce78", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233218, "uuid": "a2984e5f-5294-4a06-bdc0-3e1fe17a7b79", "comment": "Malware payload", "value": "b5e8e7d5e769e018b8b3509f07e8785dc39e931084337612946d5c081fda7e0f07e1bfe77a10fa3353a42cefe9d3fb06", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233218, "uuid": "c5420778-beb7-4b04-8897-e561e83c7de5", "value": "T18E42C0DCD550C817E8FEBBB5F456973AAF45D0C399E2A840F1BE474B2C81502289AED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233218, "uuid": "70248134-ba85-431e-b8e8-2aa307d326b5", "value": "192:3g2BJ2jF8kwLktA7uDoBLTNfokloSbJoyiLIlfhGdd43JkZVbOxKJ:3g2BQjpYfvNfvlJbvfQdS3uv2KJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233218, "uuid": "fbc2493e-b6c7-426e-8e2b-41f6e4ad758d", "value": 12006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233218, "uuid": "113eca3d-0315-4d7a-9a7c-079794bbdceb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233218, "uuid": "94036ddf-8938-4787-8ee1-3eccbe438b72", "value": "images_20260728_011706.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e009e33c-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221109, "uuid": "4d7bd29e-db4d-407e-923a-8c729caa42f4", "comment": "Malware payload", "value": "abffa50bd9ebee64d32bb904bd828e63", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221109, "uuid": "d92208cf-ac80-4cac-9d3f-ed32c0b736b7", "comment": "Malware payload", "value": "cb7a2ab4fba4e27419af796df33bbbb293926bcb7316a420b6ebc9f7e4c6994c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221109, "uuid": "9f132075-6f6f-477c-8006-9325bf850626", "comment": "Malware payload", "value": "ab9085cc167db05182656f99da16e1b5b4f2fa4b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221109, "uuid": "29c96e5a-177a-4fb4-96c7-7819ff247ca3", "comment": "Malware payload", "value": "4e504be77a83d8f13606635c913aaf3e396e484a108b438a2bf8a89561405875e633a44bd9af2865d262bf1cfa2e02d9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221109, "uuid": "86bc24fa-ee0d-4fbc-9b10-69ac8ad3c8f5", "value": "T1B4717E1452FA342DD8F648B81CB6F61922CC546269AC4458F095676CF738FC72D0210E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221109, "uuid": "972e0f48-33b7-4385-84fb-dd892ab5498e", "value": "96:XphsrZNYCddTAIp0PtomSs3LJwGN4GZr/U:uLTh0PtoU7JwlGZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221109, "uuid": "f85b9a8e-2bd8-4ab3-a79f-29a15daac0b3", "value": 3726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221109, "uuid": "46e1ed62-200a-4fa3-91f9-373d274e4c5e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221109, "uuid": "0bd11e30-571b-431d-aa22-a4a58dfcd406", "value": "images_20260728_041549.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2450f37-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221032, "uuid": "b0dda346-2168-46c8-ace6-d9a75cebc251", "comment": "Malware payload", "value": "043315ac42a916a0ca5ea4136d39868c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221032, "uuid": "242c1174-de9f-4a4b-afb1-7a33a4f134e8", "comment": "Malware payload", "value": "cc125a25463b405851f2145d9d2e32619f2e3d54fc18a61991d70d1e51259443", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221032, "uuid": "f7aebbb6-ce60-44dd-b7cb-1acd1f92734b", "comment": "Malware payload", "value": "1621da359d4ac72e658dd0d72b57f9e10073be56", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221032, "uuid": "3849411b-12b1-4489-989a-e37f24dc42c6", "comment": "Malware payload", "value": "39855e68e4eed2457781ce39b492c026b35956a4675ee743e717e409dbe8da8d3e4a05ffafdeb92e05e04df07e3e0642", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221032, "uuid": "5225a803-373c-4d0c-a6a9-d0e54a116066", "value": "T1B1B17DC0CDB898FAC5ACD4B2CEB2ED8913C6FA9946E41DCB755E4906473548F2E8B080", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221032, "uuid": "80faa58d-f393-4e52-b6a7-f01342c1a7db", "value": "96:uWQyoQnzbsAhPMGZXivhWHkfewK/jIY3Coaq/QPrjqh2Ow6jZQg6pPnyMLwmHdwc:uGFz4MN98MAewYjtCoauWk0PygwmHdwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221032, "uuid": "127776c8-83bb-448b-a084-0eb652b6cd79", "value": 5362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221032, "uuid": "f9731fc6-ef43-4749-9c2a-66402bc5863a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221032, "uuid": "5dc1b196-7e14-4ef4-b2f8-573a921e5fc4", "value": "images_20260728_014549.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1f1acb-8a74-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785236911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236911, "uuid": "00676c7d-ac7f-4619-94a8-0d2baed3dce3", "comment": "Malware payload (RemcosRAT)", "value": "cb3ef71717f870398cb66d18be752719", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236911, "uuid": "794aef66-ad4e-44a8-b83e-33c474844ed3", "comment": "Malware payload (RemcosRAT)", "value": "cc4af2fdaf3844b3f005486b3d9a6cec3fcf9a0384537ff4151d3aa76257acf1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236911, "uuid": "449ac0d1-3336-4098-b67c-d1cfdf00cb9c", "comment": "Malware payload (RemcosRAT)", "value": "e76304d376bd27d0412fe6ee0c46a2abe3f00c45", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236911, "uuid": "ef0afc7f-b565-4da0-aeb2-33dacec40199", "comment": "Malware payload (RemcosRAT)", "value": "ff6d2f8a9dfdbdd47e35f4fc632cc719b81ff42e2384938a48b8ef8546e99fbc1497b22e4bf85ecab476617c1ca19ea7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236911, "uuid": "d1e362e6-d63b-4da3-a27c-61851c52d65b", "value": "T15E958EF0A2772CC52AB6B570FD48814AEE13E97D2DF71D96F607045E248518A02DEE37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236911, "uuid": "9e9921f4-9b6c-418e-bff7-a4d68192e6d4", "value": "96:KfuYo5ZRTZ4Z545gGVWAx9p87BHCWe82/hJ5EcIlpeE4wqxMO0C4Ya3SVW:YuYgZX4O3xY7BHWV5wqxL4Yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785236911, "uuid": "ba6e6786-c400-47bf-921e-94a83c635726", "value": 2060429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785236911, "uuid": "7089fe50-f582-45f3-9cbf-1273cf52f2cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236911, "uuid": "26610123-5da6-499d-8acb-2fe6389d7b4f", "value": "REQUEST FOR QUOTATION #4874903039.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48db2597-8a59-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785225150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785225150, "uuid": "4470ac42-191c-4ae3-8b20-dd9e2068c267", "comment": "Malware payload (Efimer)", "value": "fc99d7a06531cd8ab0d6bd228a473322", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785225150, "uuid": "0f58ccf8-74fe-4800-a498-65c58733c4d1", "comment": "Malware payload (Efimer)", "value": "cd154bf27d4f62cc67f1a6ae44bbb9cb85a8d7c15233886242299b63dfc50e3f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785225150, "uuid": "d654263d-d5ad-455a-b4fe-edf848142484", "comment": "Malware payload (Efimer)", "value": "8a1e53f79685287b4484f4e616d4b83302221ffd", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785225150, "uuid": "b3f5ae97-a2d5-4e7d-921b-21839a205700", "comment": "Malware payload (Efimer)", "value": "a3c7183d87179a29b74f83d57aaa9a393e9ff915922b0b5019e566c043abb9d141e0c17a051ea4a8580255715ee2f4c3", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785225150, "uuid": "3e53a4ee-d241-4410-98aa-59c3d8f488c4", "value": "T1C2E6335C2AE800FEE6B3513CDDE01595E156B47A0B76C9DF07A887A46D331E04ABEB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785225150, "uuid": "93045b3d-8504-4c5d-a099-5b7822481518", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785225150, "uuid": "40de1979-74a3-4dca-a7d4-2eb362a0e831", "value": "393216:qgkcxgtpQa6Z/MFlKuqbAaJXMCHWUjXAcuI3/PGTAI:qegsaKmlq1JXMb8XVH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785225150, "uuid": "b8dd629b-0bf2-4535-ab74-d54df74d9a6f", "value": 14306548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785225150, "uuid": "f4240d66-f78d-4915-9bae-f6f1b1f81379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785225150, "uuid": "8bc94274-e5d9-4b32-bec2-793f073c4508", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0975cec-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221136, "uuid": "96d376bd-fd9a-4876-849a-06a5e8f7c02f", "comment": "Malware payload", "value": "7c93147b0c33df33d86c032b81053cbc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221136, "uuid": "348cf25f-abf9-4878-9b8b-2495bb79275d", "comment": "Malware payload", "value": "cf318b1960b9562ca14a9ca4165150945091ff96602452665d55c95b361b63c1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221136, "uuid": "c894231f-e702-4f75-9bc3-11690a845a57", "comment": "Malware payload", "value": "01cc7e3a0a32e9d082b27fe57db26cd64da22467", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221136, "uuid": "36754750-08f8-47a9-ab0a-6f74ae07dcf3", "comment": "Malware payload", "value": "4b592159a29e028a238d9ade19078cfd26bf11fe3813209a24a8b98ce765cbff6d8fe7936adc8615e183f0a12b20eb4f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221136, "uuid": "8db85f29-a32b-4f33-a80f-7edc6fc9de80", "value": "T1CD22BFB696CD6726BA03BF71A6EA691F26D1757987AF20B3920D01D20647004FA0EFC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221136, "uuid": "0d4ab746-de5f-4e9d-8936-348514303835", "value": "192:kiRUPv+zCRsBTjpy3NROHLK4aEQ/DySXGeojNi6aPzVM+s2yGn:tWPw2oyXOrja7/DySWeojNaiQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221136, "uuid": "6fa7064a-9046-492a-81c1-a76dbc9e2cc0", "value": 10196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221136, "uuid": "4b99345f-09a7-42e9-a5e1-85f5ea9e2cbe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221136, "uuid": "ce454c3b-48b3-4671-a81e-7f293836452d", "value": "images_20260727_132605.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7749c87-8ac1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785270030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270030, "uuid": "8f36730a-62c6-4d11-9e47-d5c083f7d2b2", "comment": "Malware payload", "value": "fe0fdf14f854f154d45ea5afd572e851", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270030, "uuid": "ccd0fa75-4386-424e-8fa0-a6bb40c00d30", "comment": "Malware payload", "value": "d02fb84cea88610da9c7d84902c64e2e11d66795ef56ed8a5e4f77d19c294175", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270030, "uuid": "9f8d80a3-0546-4609-b684-acd999d30dca", "comment": "Malware payload", "value": "8714ebae8ae100d40d526d00ec9e6c1cec1caa80", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785270030, "uuid": "f42bda9a-ba06-4d48-a535-8872313256ce", "comment": "Malware payload", "value": "98a2d61b6fb6dd46ae7987b1f7c6076e666c94ab430955d7829f585e4953f9c4ad9f3a8f42cb9044c42ee8222fe3292e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270030, "uuid": "029bbc80-927f-4f2f-b91f-8c2dd3ddf85e", "value": "T190C28D956A867C44BDC98A3E4CBE2B0D6DF5C3D1324942AC3D8B3C719C15F9CD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270030, "uuid": "65f1a45b-3f7b-4d86-9762-55d4bc9ad667", "value": "768:vr8vCB+25j6es8Rd9FYpMSUpi+20qUpi+20YQX:T8l25JLd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785270030, "uuid": "dfe24bb1-378f-4b0c-a255-ebcc8dee0d18", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785270030, "uuid": "dcd5452f-9d7d-41fd-b727-24b15ec80e13", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785270030, "uuid": "0e7e3466-1c06-42eb-ba33-333caf13bf7b", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b023e1-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220819, "uuid": "71bdb1ec-7b2d-42e9-9a6c-244296069505", "comment": "Malware payload", "value": "ed8ca5f4dafdd7fc8ae3a6acc0441846", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220819, "uuid": "bb9dccc2-4f66-4a7b-9bba-e3a516124ca4", "comment": "Malware payload", "value": "d0a24e758ab89d6bd36ff53ffef2d0f12365ab15cef0edd02daba97f36987ae6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220819, "uuid": "e5e862d4-8589-4f7c-a521-0c29ea3640cf", "comment": "Malware payload", "value": "671d44c4ad5341f3a8161febc76ba4cf466a6c1b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220819, "uuid": "1d85b7d0-7973-4699-8eb4-debccf1a40a0", "comment": "Malware payload", "value": "756f55b3581310f1bc31cc08f1877b092fcfb1369eeaa8945144023201f42468217603fe9e9b07080647489586751f50", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220819, "uuid": "947b4072-d889-459f-97d4-098f4d8da905", "value": "T17472D0268B9D9160F6DF08B18DD30BF8761C9169BED1A0DD31F3EC55243246C916B0ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220819, "uuid": "b5ed11f1-d5bd-45b3-ae64-cba272eaa5ac", "value": "384:J1stvZf8vkjiF4N3Ejfb8iF//LerAkUHP3cblB256Pw0CWi:J16Z0vkjihrbpx9WRB2EPdCWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220819, "uuid": "330ec270-04f3-4e38-a579-12e1688bb781", "value": 16585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220819, "uuid": "a3972df9-de05-48b2-8ee6-d4a99b42856b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220819, "uuid": "6120bf64-3750-406c-8306-e8fcc3cdd32e", "value": "images_20260727_081833.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72556f63-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785211046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211046, "uuid": "6b43dd1a-2fd9-4f72-8c87-27cd800b084a", "comment": "Malware payload (Mirai)", "value": "7a504ee166a69bd54862e9d99e4ac1b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211046, "uuid": "95aa171b-8d47-42d0-a95d-05fc9d8c5491", "comment": "Malware payload (Mirai)", "value": "d117f06588c31308b2e3b6e3d8efd3b565085dc0e9cb59d718678b8231ec1465", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211046, "uuid": "21a9b5a4-bf0b-4276-a9e2-98951d20cff5", "comment": "Malware payload (Mirai)", "value": "166ef5222659baaf05fe3978821be8ff52721aa0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211046, "uuid": "30157eaa-be7b-4e0b-810d-6ce1cbad2bc6", "comment": "Malware payload (Mirai)", "value": "5ef2e307bb29b46967ef90da1b08bce099ce803ca20726315ac8e7f82f240363dc2886a73167170a7102bca27acb3bac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211046, "uuid": "ec3b1238-f293-4423-ad55-63673b6ef191", "value": "T113D58E17BCA105A9C0AA96328DA69192BB71BC490F2163D73F90B37C3F72BD45E79704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211046, "uuid": "6446400d-5437-41d3-9976-6c1c53df4ea4", "value": "49152:e0sHCbkIHAbL+lusg7wwaeo9hNqB7+JrZYUcuQ:6S+SlFwalBqBiHVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211046, "uuid": "12588bc1-9d09-4714-8831-992e50ae1076", "value": 2895072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211046, "uuid": "329bebd4-19cb-4064-905e-b5d8a6343562", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211046, "uuid": "af822eb2-a658-4fe6-a6cf-8bbe817b6184", "value": "router_exploit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf40784-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1785224456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224456, "uuid": "3d7f7cf7-49d0-45b9-af8e-d0a637245015", "comment": "Malware payload (DDoSAgent)", "value": "deafec156095fe8a2e64b0c24058624b", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224456, "uuid": "161de9d3-84cf-4121-b191-5ba6531e92eb", "comment": "Malware payload (DDoSAgent)", "value": "d20ebb510829979e0fc2a0f99197b63de214a6f78ba6556a5187c1ec44be29b8", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224456, "uuid": "f4f6f081-bb00-48ad-8e7a-c6b134c240e0", "comment": "Malware payload (DDoSAgent)", "value": "fb42c7f151047d736c70ca914252e316c079521b", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224456, "uuid": "cf80d4ec-c1c0-4658-a99e-eca6d2f6dcfa", "comment": "Malware payload (DDoSAgent)", "value": "edda2b40b7759267b6a17220c9cdf4cd9c2fe593aaeb6b7b0333c651f5d8e8453d957d9c9fa19ad8730ee9ddda71f35c", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224456, "uuid": "66b70d22-a997-4d94-9f52-4851d6af227d", "value": "T16836F761BF88EE0FD29431359AE6C23433D93D01C1E065369756F71E2EBE2A4891BDD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224456, "uuid": "12a71578-ca0b-467f-b055-bea0255d3d08", "value": "49152:qUgIld52dBaq9yKgfb1fHtm6+9s1rt5EM:wBZRA8/2pjEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224456, "uuid": "55c0c5b2-2a8c-420e-8c0a-7d5199be4c7c", "value": 5177492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224456, "uuid": "73452bbd-9214-4ed3-a064-ff39b33bf96f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224456, "uuid": "021be080-19f9-42e5-939d-926d3b2e9ffb", "value": "xfsaild_sda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e01cc8a-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220837, "uuid": "1b8f9924-80ac-40fa-877e-ca3a55e4ea93", "comment": "Malware payload", "value": "602d9296ed9aba6ad17a0c41f96b2bc3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220837, "uuid": "9e15191b-4c40-4290-b891-138eaa5d9897", "comment": "Malware payload", "value": "d27e36f1aea2e201512295a7886b906b112190f82a942aaf9e4483b84fd9fa86", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220837, "uuid": "0c4166c9-934d-4c72-bd7e-10cc0f6cf080", "comment": "Malware payload", "value": "3b8256161d7a854b5e0679c71c38f6f72d5cf108", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220837, "uuid": "279b0cfc-6998-49bf-a623-e77484db47ee", "comment": "Malware payload", "value": "886744bff186bb5333f69bde75bb5773acc3d5bea60b419c41f8bd675fd48c9d0ef661790410f98ead68927b5ba0a9bf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220837, "uuid": "a6ab10cc-e29d-4eb0-807c-c58cebd848cf", "value": "T15672CF76A6640D31AC229BF9AAE0C326CD81BDE11EA251830D3FF0FDCDAD04A2D511D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220837, "uuid": "c36ec7c4-abf0-4063-8a4d-7b6d3bfc1892", "value": "384:FaZHtOSNB5EI3dXPFXXv2YkYAXwr9Q2q82wlBKebsXaloluqKw:CH9tXPBXv9k1Xwr72Q9bUbu3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220837, "uuid": "7d9ada28-e56d-4a32-bca8-98eafd2e9014", "value": 17440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220837, "uuid": "8b31dced-4f02-4038-a8ce-67a9ff20e68d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220837, "uuid": "f04982eb-9d06-4f45-933d-5d8a1e28af9d", "value": "images_20260728_041427.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13af671-8a91-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785249404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249404, "uuid": "fcea4929-7d37-4613-ab4f-b15a5ad93648", "comment": "Malware payload (RemcosRAT)", "value": "5302b3f0a89cf0b19080dbe1325ab85e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249404, "uuid": "bab69a1c-8f21-41f7-849e-15f2465dee29", "comment": "Malware payload (RemcosRAT)", "value": "d296afca2cf56b95c65cac551b9e6699df51d58fa568b668322797f635cef342", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249404, "uuid": "3cf7510f-b339-4bf9-90fd-85c6b83d0cf8", "comment": "Malware payload (RemcosRAT)", "value": "9d2827700e61d01eeb712b1fe99ad8bfaeb7a7e3", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249404, "uuid": "bd9905ad-5cec-4cdb-bd19-84319557d7d8", "comment": "Malware payload (RemcosRAT)", "value": "810d3ab49d3326a97752f11adc033fc1727d4a404831c894baee3ffd518610712f196a6ed5b3a70b2e5ba9913c57d2c8", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249404, "uuid": "75474f4e-ffaa-4231-93ed-ec91b3a44179", "value": "T1A4510A6E24543E4FDBDF057197FE89A4CE1E25162EDCAF43CD12A11301AFE862DA9324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249404, "uuid": "73893888-50f9-41df-993e-8b0cce71d4fe", "value": "48:pBqoH+CTs+uQ6fnIXmF8auijhG8AbsWZ5pb3+gT8WbtyNX11heD4QtfIFwhqYvDw:pBqoHTTs+uZ0mF8Go8AYxNv1h8biFwhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249404, "uuid": "cb604ea9-b60c-47b6-b325-bd2c88b5a4e5", "value": 2851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249404, "uuid": "95453c49-0e3a-48fa-97a8-588ef6d6e4bf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249404, "uuid": "6f84340f-887a-4446-8f3a-a392480eb5e1", "value": "REQUEST_FOR_QUOTATION_#4874903039.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0811f0be-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220746, "uuid": "2f12e160-ca16-45d8-bbbd-240c7e577fd9", "comment": "Malware payload", "value": "77edd32fb31553e8d81a6b06e61b8277", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220746, "uuid": "8c041e02-bda0-4a2b-b765-bddeb6c7f60c", "comment": "Malware payload", "value": "d2d14ad4156d78909f6281223f4202402add57055e9dfa9d7fb7ffbf50e426f4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220746, "uuid": "51f5ccc2-ceff-48e5-9ef1-c40c6aa25b93", "comment": "Malware payload", "value": "cb3d79e397cc8f98cf2ebe1fd3e2e0226638fce6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220746, "uuid": "3c78818f-9993-49cd-a881-fefd3be1b919", "comment": "Malware payload", "value": "339575be39483171aa59f93ff4717a6fe07fa4aa04523975306fbf65aa6b33f5e5a9af52f88e9ea20b2c290b3616ca04", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220746, "uuid": "98f01d19-b325-4844-af88-d5e6319f53bd", "value": "T19C129E01E0968C10EA6BF33750A25B1AB7DE9EA690675156562CFC26DCBC6FCBC1C31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220746, "uuid": "77c2364d-d092-4d8b-af1b-3b31ea1aa8aa", "value": "192:z+Mfnn7zmzewlIOctp8OV+yG6FGKouzx0/6kFAJ8c0BaYLOgpBZeQfx9OP:/n7z+ewqOcz8E+3bKoh4IzLDFnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220746, "uuid": "731fc3ee-7c0b-4f10-b013-68b17026d45c", "value": 9685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220746, "uuid": "750fd7e0-84a6-47f4-a807-cbb964c0c4d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220746, "uuid": "22b58f83-f202-4bd4-86df-95528d3b1a3a", "value": "images_20260727_204420.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0623e3df-8a21-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785200986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200986, "uuid": "ae850c07-f8e6-42e6-ba1d-6f658fc33b6d", "comment": "Malware payload (Phorpiex)", "value": "60b6c61db4b78d713fa014568db9263b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200986, "uuid": "e5253cae-b281-448f-9756-b260555f4800", "comment": "Malware payload (Phorpiex)", "value": "d31040a2b95b66340fe07d1bed67ef96fbe1d60e6635acc2736de3d648f90131", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200986, "uuid": "3770818c-3a2d-49af-a54a-1944ebdffe86", "comment": "Malware payload (Phorpiex)", "value": "fc9e19460bd3fd1c997f76bf7d31c85b31b0dca4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200986, "uuid": "f8a83a46-894e-450b-bda9-34476c4b9c19", "comment": "Malware payload (Phorpiex)", "value": "b275fb1916e6e33fcab24beb20c8ea71098f840fcce646a553be89a78b94c64e2569702f343773c956754ca024ac14e3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200986, "uuid": "e5ab239d-3ccb-4d65-9371-8a6690869b8f", "value": "T17D623A0BA4818035EAE04075827F526649BEADB623C4F9D7F7E0A8C94DB4BD1F43216F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200986, "uuid": "11ca7190-ed96-4c5d-9171-65b19386723e", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200986, "uuid": "8cc39634-a40e-40dc-af52-3ac0453e8cd3", "value": "192:AWbzsGnjXgjk8LcRI+Q1RDMlYfV/F5oIVUBKUSftzQFBrfgJxTmv8U9cthV9ik:AmXScCtfV/ro6toB0av8U9c/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785200986, "uuid": "dca073ba-61cc-4cd7-9312-03f6ed7e92c6", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785200986, "uuid": "547d886f-706a-4754-853b-8a5a7baecd73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200986, "uuid": "33c1e7f9-7ed8-4965-8390-475d8ddb5dcc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be811837-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785245963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245963, "uuid": "dccfef27-c00d-43c2-ab94-31f112b22c69", "comment": "Malware payload (Mirai)", "value": "4ccfd1ec26ea5cdecf71c749759e6889", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245963, "uuid": "e853dfbe-a834-46eb-98a5-30eeb0b0d310", "comment": "Malware payload (Mirai)", "value": "d326d96e496043cd382984ed014c7f6887b77ad611d421bb7a4ddd6212a0b2d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245963, "uuid": "4a0d5a98-3be5-4b7e-94e9-dafff6a621fd", "comment": "Malware payload (Mirai)", "value": "5ea0b75f87d6c08aada0b374d8a6842253190996", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245963, "uuid": "9caa4e8e-d4fc-4d94-81c9-3235d2de3399", "comment": "Malware payload (Mirai)", "value": "2ea7fd3c8933a5e799a16cbe685ed8e9cf0a4f5fde6bedb19f16488ac40da61e98a6b5d3de3c5cb637432bebd581ec70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245963, "uuid": "e3642d49-1515-45ce-ad3c-a93514d222db", "value": "T102A3E84ABF601DBBD81BCD3705AD0A4235CCA60771683B757934D928FA4A54F8AE3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245963, "uuid": "9a8a9172-0e57-4007-bbe2-bcd968221534", "value": "1536:l4zP9RywgwxreXlBc/9uOL4SF8dTL6roS87enwXUPaulg8/xsJx5iDD:YWDwxqXHc/9n8dfusx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245963, "uuid": "1bb79624-d6c3-4161-976c-9f31f3b29e2c", "value": 101068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245963, "uuid": "42cdb46c-7f54-4934-b336-3e7a5af4a19f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245963, "uuid": "cda853d7-7c94-4fc9-9061-27b9855a8517", "value": "FtoP", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17763d2-8a88-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785245619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245619, "uuid": "bef1aee4-b523-4dc2-9a8a-cf87eabd2c7d", "comment": "Malware payload (PureLogsStealer)", "value": "4555ce1f128a9c70a0cabb1cb14afdd4", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245619, "uuid": "0c04d47e-d212-4038-8010-85f2c81aa6bf", "comment": "Malware payload (PureLogsStealer)", "value": "d33bc3e0969ef5e0960659f9befe232bdb4f8ab9b6b1e2556f2dcf4f8fc35659", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245619, "uuid": "bb927e9f-8f9f-43a4-a438-8b8e6dee5256", "comment": "Malware payload (PureLogsStealer)", "value": "2f4f8cd9ea48aa1f5976aeef92a0b9fe895a5565", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245619, "uuid": "836e029f-08ba-4eeb-9215-453f49407a3d", "comment": "Malware payload (PureLogsStealer)", "value": "b3132c39fa2118dd07d7b13cee2ec111b803506165d445360c95ebc6737ef94b872ff07c69a05d624742dfba81bfd766", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245619, "uuid": "73bc6f87-a834-4bef-ba45-c1dd69272ed5", "value": "T19D06BF05F7D406D4D46ADA30CA6B9B32C7F1B89617B2C34F1654C70A1E73AA19F6B322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245619, "uuid": "ad6647cf-e2c0-420f-a33f-fa8c391a6f90", "value": "f469ac0906218570f79c54d1b58dc057", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245619, "uuid": "9d127c02-a295-477e-9017-4d79d428a051", "value": "49152:8sW/a2XunPaAlBZiOK/sMeOgFVGAPFaTJfRRIf9miH4gvCwlH6:k2asFPFUSV5ImH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245619, "uuid": "552c2ceb-f844-429f-acf0-4623be16964b", "value": 3995136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245619, "uuid": "ea3c2c85-65ac-479f-b485-5c47d346f39d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245619, "uuid": "a2ebda00-b11d-454b-a055-89a747b272e1", "value": "d33bc3e0969ef5e0960659f9befe232bdb4f8ab9b6b1e2556f2dcf4f8fc35659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2433d0f5-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220793, "uuid": "cebbdcf0-27a9-4f6a-b00c-68af11c152c0", "comment": "Malware payload", "value": "14148f45e49cded644154d16a26c9bea", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220793, "uuid": "ec9f43fc-2bd8-4c26-b7d8-c3ba4514fe99", "comment": "Malware payload", "value": "d42a228f85319ad6c0d523c9052ea6b04fc7adf4a7421eed4407c60b450fa9bf", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220793, "uuid": "defa7d3e-a2e9-428c-ab04-0d9dd04acb2e", "comment": "Malware payload", "value": "8a5938f84d623a8e6d91d7dc8f70f78e58fb5e12", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220793, "uuid": "c8916d8c-e9c4-4051-9b18-6b8a5cef4d46", "comment": "Malware payload", "value": "5083036afb02b451471bc15c733e37bd2847f64b91161fcd8b4871404c01545574376b0ddc572eaa035489897d18c018", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220793, "uuid": "0942725e-8ba1-492d-b0d1-9c4625d931e7", "value": "T1AE02BFE09346BDCBF2476AB83BE2B69803B718809F4D1B5E1246344FB00D9D96F880DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220793, "uuid": "a692eb13-4e39-4cc8-88cf-05c482882cca", "value": "192:AK87Ty0iRpL5R2qBf0ufsxOv7YwuyFqSUb:JeytZaqBffKOvUeF9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220793, "uuid": "41098263-ca51-4575-a008-1256ccc292bd", "value": 8873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220793, "uuid": "5fe57541-8d30-4ce5-957f-0eb45c8e1f1a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220793, "uuid": "a7417875-3846-4488-9c0b-b1fdc4becbc6", "value": "images_20260727_152444.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eafdb477-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221127, "uuid": "de92a72c-0a63-4092-92ff-555155a979cb", "comment": "Malware payload", "value": "3d518c1015963881090dfbde22f945b1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221127, "uuid": "a6d9ddec-dca5-4d5d-ab81-6f30dfcac94e", "comment": "Malware payload", "value": "d488f2d9c3a80c223eba8a5edcddd375e7eafe2c3299a6d824785959cf2025a1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221127, "uuid": "a32fd4b0-945b-4c99-a9d5-7e7bfed1e959", "comment": "Malware payload", "value": "8978bd2cba7231479d36383d91e30f88ee291f09", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221127, "uuid": "13303c47-da70-43dc-9941-853b4e3b9a91", "comment": "Malware payload", "value": "2b7ce8897da1c9931ca480d9012700b2bb5d0c9d5681d27e205534830ef135fba61cd9ec45a8245e51d76af7aaa723ea", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221127, "uuid": "4c80ab32-62d3-451e-8731-63c7608b131d", "value": "T10662D178528916C0DE4342EB3860D3F6296AE787105F1B1B5E2225D3B13B42C6F4F99F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221127, "uuid": "21f8a104-2a5f-464d-a5cf-568628b10fd0", "value": "384:TQPGpmkG1nh9GVNzFzQLOtZ7Y2qOXkTKE:cWslh9cWLOnDUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221127, "uuid": "8d0ac862-260c-4bc9-be32-2f06d390eb5b", "value": 15818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221127, "uuid": "1d1f5c76-27d8-481a-9bbe-0b7b8524c1f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221127, "uuid": "05a807b6-7a37-42f5-8af4-20d215c86b10", "value": "images_20260727_234038.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453bc43c-8a8a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785246189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246189, "uuid": "f0ee597d-53c9-45f1-9146-4b8225905581", "comment": "Malware payload", "value": "8454959699e23ce4dbb3bbdd42c7c9ac", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246189, "uuid": "767bd98a-d282-4be3-a130-9c4a3ca9b69f", "comment": "Malware payload", "value": "d4954ecd1d3ae26f5ebf9d373c798efcd94584aaf7644f88eea004af0d097b4c", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246189, "uuid": "f3544b09-fb10-48ce-a703-ea6597737006", "comment": "Malware payload", "value": "114b9bb72a0e5b003a512b4b28f84266a36e87f6", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246189, "uuid": "13736bcf-0c48-45e2-a80d-d96eded240b2", "comment": "Malware payload", "value": "0f903392d2297600e840fe090848a1da40d874f46b6642b6909c745c8aa453a5ad8a77f8d322281186b84d8c34dd7aa8", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246189, "uuid": "2fba0554-f0d6-4b87-b32e-cd991dc102da", "value": "T1B5D60103FE9509FAC49AA3359EA655527B24BC1C177123E71FA0A2B62F333D16D39B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246189, "uuid": "e53a3967-1c8b-4910-b424-2d76e6f1a22a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246189, "uuid": "2841d155-d7f8-4b29-ad06-2f07705fffb5", "value": "393216:SCQDqnKLoJwcvjbKTCjOaTYcPwPnO4Xj9tC:S4p+TNaY94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785246189, "uuid": "448dad94-76a3-462f-9c5c-ca94bc17b8ca", "value": 12938600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785246189, "uuid": "4d0bf6e5-6398-42f8-801b-266490f310ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246189, "uuid": "1ce1ed26-06fa-4c0c-bfaf-28cd92292f89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ef4c5e-8a40-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785214351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785214351, "uuid": "7ccc0d02-cae9-492c-8392-29332d9f6f34", "comment": "Malware payload (Efimer)", "value": "51ef4b8441aa94c9c2b1280e869e5a2d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785214351, "uuid": "598e99cd-6019-473d-81c9-fed4ef517dfd", "comment": "Malware payload (Efimer)", "value": "d4e159aa3c7efe664c91952efa73624a1cf50975d64402aaaba290924cdf8ee5", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785214351, "uuid": "96d40e3e-52fe-4274-a5da-dd512aa46957", "comment": "Malware payload (Efimer)", "value": "2066eaf346d11cbf2b73eba7027655f960de395c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785214351, "uuid": "46ade1e6-fa7e-4dd0-a166-1c5e5f1f32f8", "comment": "Malware payload (Efimer)", "value": "995be54896da32c9f382350b628ce5f8667fd1d0b598212e3be738a584a1ba71c57ab143d2622bc94894336e18d0a150", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785214351, "uuid": "73d62473-c560-44c5-9dc1-f46640b157f5", "value": "T1F2E63314A6D012B9F8B3503DDEA28A9D9094B4361731C5DB47B8C77DAE0F2E0893EA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785214351, "uuid": "cbb30cbf-4bdd-4f47-a9e5-9879896db5e3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785214351, "uuid": "07031ec2-a02d-494a-965b-c1adfeb24ba0", "value": "393216:92xKHCjuyTeM4OMVyohvbhEkXMCHWUjXlcuI3/PGTAI:92tjUzOHkjhEkXMb8XSH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785214351, "uuid": "784b4315-bd35-4811-8c57-826727579863", "value": 14324498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785214351, "uuid": "eb5cf100-5cff-4d5c-944a-e2e153df6319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785214351, "uuid": "6e452e66-3624-4bba-8d44-92a33a7f609f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3529486-8a91-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785249407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249407, "uuid": "a20e04e0-efdc-40fe-afed-13e029ce58a4", "comment": "Malware payload (AgentTesla)", "value": "8cb47bef835912ab8708671914a2bcf1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249407, "uuid": "8f16a7c2-bb50-4937-a62c-819ca4b100c6", "comment": "Malware payload (AgentTesla)", "value": "d6fb2c1db9addb338eae76290878ab6fb0701f139e415a3d2dffacdde4392489", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249407, "uuid": "12011448-2b1c-4c89-9aa5-c76d97dd1e1d", "comment": "Malware payload (AgentTesla)", "value": "2388cc2ea6811b69d9dcb04693a42f417b45a8ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249407, "uuid": "33790f81-0368-486d-bdfa-7322670e1295", "comment": "Malware payload (AgentTesla)", "value": "ef841063c105a3e58ed3513a420a96012ccb08a935668aabf26afc2e5891a4fa84dd467dd9ad3e2505d7f8c3e705d6c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249407, "uuid": "e82997c5-fe55-4c2b-9ae9-4c5edcd2a9fb", "value": "T17E516DCAE92C6667EC28B4B7741512FE0BC47701713AF1E4BDE95AE510477A721312B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249407, "uuid": "3154ad9b-fc66-4d29-b52d-6430dbc318d2", "value": "48:9ANRU1mrCyEFZGdP2zBpztC/ExR7mcLm0JdX/QG2WUUe0vvqMxwdss/LOj:9R1ADOztCMxRRPPPQwqyvtK/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249407, "uuid": "31f56604-fc39-42b9-be6b-18638583d50e", "value": 2927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249407, "uuid": "27ef2a2b-30fd-4b43-b392-54d88d54fc92", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249407, "uuid": "b5513184-e705-4fb2-8eee-9b22f31c99c5", "value": "RFQ230092.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774e90f3-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249709, "uuid": "84125a30-b0a3-4244-8cd2-dcb8935d7181", "comment": "Malware payload (Mirai)", "value": "2f123d251838d2fd5919ca6e0b28455e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249709, "uuid": "8b252ad1-3645-4adb-a34e-c40fbae2337f", "comment": "Malware payload (Mirai)", "value": "d75ce59c2dc7741cd56ef17331990c5f018d67e50094d19f8ec18c77218f58ea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249709, "uuid": "b13e87bc-d87a-4bfb-9fae-9fe4106e3bea", "comment": "Malware payload (Mirai)", "value": "4f8ec2ec7aa7544769b2b8ae5959d608e90e238b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249709, "uuid": "76827128-916e-41d0-b145-703d641dc12f", "comment": "Malware payload (Mirai)", "value": "6ab5b76336f71200d12d073cc1028209f2edafebfecbb7bdfae3c0ce1768df9d875c4f656df650ed173813ccb76b5042", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249709, "uuid": "30a01ed1-7b07-4451-a23e-fea861b71480", "value": "T116D2E1A545568F48F7EA45B80CBAF08D39D9C336BAC6C272BC88357564067D0F06CB7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249709, "uuid": "fb5f138a-908f-4b01-ab84-d8db39d7f873", "value": "768:KOU4LPVjtkHZeaDHKmBwaNuVBLwxPcMhzMGq2inbcuyD7ULWykkA4:K34rJtkHZzqLw2izM3pnouy8Lzkk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249709, "uuid": "e9bec3fc-0de7-47ae-9fe5-54e3c02d934d", "value": 29908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249709, "uuid": "194ca086-7c94-4bf8-a283-f0dae71b1e65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249709, "uuid": "f2eb8b25-7d77-4204-b091-31b4f1893b71", "value": "zero.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4360abc1-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220846, "uuid": "1e13981a-40cb-434a-bcb0-aa5ef09f7be4", "comment": "Malware payload", "value": "2c52b2aec5a8db6f4914f7d7a1686059", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220846, "uuid": "e3a7d5c6-e9d9-4af6-b1d0-b4ca35c7661f", "comment": "Malware payload", "value": "d77fb4007868e7473ecdb840abdfb9494b3c5047da66404b8106717de8671a42", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220846, "uuid": "450f05b3-7914-4b52-946f-2f8cb26a3eb8", "comment": "Malware payload", "value": "4ed012a3bbc078a82ce17e292065b1592dac25b4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220846, "uuid": "144d7feb-9131-496f-b79e-50d1a763ca06", "comment": "Malware payload", "value": "aa2482323d6cd7d97cb8a8031e833747e927e99459f28fd10def6ad466cee47f5848e43bd2f8474a8d6af47bb1e13862", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220846, "uuid": "518064fb-6ce7-4c3b-8d24-f43c243fac55", "value": "T15442D084364B885AED69C5DD0263B78B4349E74B0B2EBFEE5104332C46937A964668F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220846, "uuid": "ff133d97-f0c0-4a9e-9d19-ae02391334c0", "value": "192:Yk+xe7k8BGYWD9Rx43kjkW+gZnaZXAg4WQBNxMXHpOj+JwcoGBoYAef9Cd:YkWeGvhRx4Uj52Qg4WQnxsJlo2Cd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220846, "uuid": "8058436b-8d1f-4a02-aca4-052c557b0d49", "value": 12698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220846, "uuid": "97bd9552-9c68-45ff-b7e3-7cad427cfa34", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220846, "uuid": "55965c84-b39f-44cd-80eb-4f5efd912aae", "value": "images_20260728_051044.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49663f15-8ab8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785265953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785265953, "uuid": "e3cf7be9-1543-444e-ab54-57956bb2b565", "comment": "Malware payload (Mirai)", "value": "2316fec3153c834239670393bc6fc3fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785265953, "uuid": "7b07b38c-889d-41f3-8243-43f08f4c7ab3", "comment": "Malware payload (Mirai)", "value": "d81fc15c5209b18130b08a9d7182a78aa3f6184ffb79cabd7dce4cf5a3d3cab4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785265953, "uuid": "2be4db70-05e9-4c39-ab64-9d0073afd0dc", "comment": "Malware payload (Mirai)", "value": "daa41c82789618e1bb1a18774024f4db7c4e34c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785265953, "uuid": "36f17057-0650-4921-96d5-32243a112a7c", "comment": "Malware payload (Mirai)", "value": "197f7d18dea196c6e5555f77cfb3dda20a3e0c97bf39587b2f0ecb22678d70e65749080c68c0a46382059c7447d17f3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785265953, "uuid": "6d97150d-d743-4e53-8ec3-a76f8b11f5c4", "value": "T15DE30849F8519F22C6C615BBFF4E828C772617A8D3EE72039D156F25378B85A0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785265953, "uuid": "fdf02aa1-dc90-48ca-8db5-6294a95c126e", "value": "3072:UDNgbcaYDekl2LQ4vVdYoHcSjsJshPknugs:UDNOgDmQ4vLZcQYshFgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785265953, "uuid": "2a26883b-f0f4-4288-9328-44370d0f35d9", "value": 143916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785265953, "uuid": "10fb15a4-1f18-4940-929b-be2b05576a54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785265953, "uuid": "a01e04fe-a1a9-4c37-87bc-b3a02c2b4606", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45686205-8a96-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785251343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251343, "uuid": "2b7faed4-ac5f-49e7-a039-c6d7f7781727", "comment": "Malware payload (Mirai)", "value": "31dae3f311855660f3504f41b138f472", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251343, "uuid": "e5d9b8cb-efe1-472b-8a83-da5448278004", "comment": "Malware payload (Mirai)", "value": "d854dfb7c62d2c883f8ac3676e09050955de0e2286b96b392cc4c9fea34b24db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251343, "uuid": "168cf738-5cf3-42b0-9a77-36354601769d", "comment": "Malware payload (Mirai)", "value": "ea6ff1b4874ab2b51066a482ddaae1e8579b9570", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251343, "uuid": "17b44417-a110-453b-9194-d8e478a3bac5", "comment": "Malware payload (Mirai)", "value": "a4b79a5f026c6f85dfa1101d47d34c69d3c9341f2bcbff49781adaada5ae8dcbced5e9fdc10659937ce8e8c4de7d5cf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251343, "uuid": "58355f75-b469-4d97-a968-ea9ad5ca0aa4", "value": "T123246C69BA0F6C41F2C3D3F8DE8C87E13A1B35E3C7768971791212ECDAA39D95990502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251343, "uuid": "cd20cafd-146a-402b-b761-9902ee019009", "value": "3072:dkWYlFi68+KrWnlEj+a8gHW2ybNe7baNzuWBdpwMDkvboqD3y:Kji685rWnlEjv8KW5bM7ednpwTvboq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785251343, "uuid": "f78ca667-5e4e-46e9-a166-d2121071e332", "value": 210936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785251343, "uuid": "e9827aa1-4bc0-4707-bb91-e4cc90266ae0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251343, "uuid": "41676e3f-f283-49ca-8b2d-64122737cb64", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26767905-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233253, "uuid": "3db9da13-55cc-4336-808b-638fa0e2552f", "comment": "Malware payload", "value": "8be05b17ff5a66adb7710c6c751ce61a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233253, "uuid": "380aa200-39f3-4af0-a240-06e9974eb9a5", "comment": "Malware payload", "value": "d88346856911fe4e4f1bbc5bb2e54cbb2c2737d76e6f4c89bd426077853e5e48", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233253, "uuid": "33743adf-52cd-414e-bc50-47660503e527", "comment": "Malware payload", "value": "e48bd404620bc2c06ba861fff9b1da7bc4fb3a49", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233253, "uuid": "e20f8198-013e-4cb8-bade-67bdf708393d", "comment": "Malware payload", "value": "f6b04b4742103b2f3176f4c5f0477522b02a4487ea382b4dd52af966b83762e7367edf03d2f637d7e0f8483e277c12d3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233253, "uuid": "c7a34878-ddba-4c39-8305-43e4174cfc46", "value": "T1CA42C095C84F27E2CA4E44FB58EF1517155DEF7522A29032B28F6B482C140FECD603E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233253, "uuid": "22bf3c3f-3f92-44e0-ad24-bbfdd6f8d8cc", "value": "384:FYnSjdKx6WbrPV1yuknbg79QiehPOZjHcZa:ikdMPbrPV39QphW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233253, "uuid": "865f6617-38f6-41f3-9cdc-d4130f99a234", "value": 12454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233253, "uuid": "63de60f8-4e69-4c4b-8d29-daed23051f8e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233253, "uuid": "3d83079f-bda9-4b4d-8ab6-be028c13d14f", "value": "images_20260727_201151.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "232b2dfe-8a7d-11f1-bd95-42010a9c0009", "comment": "Malware payload (AdaptixC2)", "timestamp": 1785240549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785240549, "uuid": "255e4b21-412c-48df-b7fd-a9cd7e2fde38", "comment": "Malware payload (AdaptixC2)", "value": "a60ff47f224bebdaeac73aeab370854d", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785240549, "uuid": "d264c238-1a19-4795-9251-cd233203fdeb", "comment": "Malware payload (AdaptixC2)", "value": "d8b6088156477df342a5387bc81aef1e242f12d2f722e5e2030cbc51c203d547", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785240549, "uuid": "0b58164f-c5b5-4789-bf20-21111c958564", "comment": "Malware payload (AdaptixC2)", "value": "7505eeb4ad0468148a1a2b74ef007ae77ebf9cc8", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785240549, "uuid": "2d388541-5e95-42cc-a403-33d79b603997", "comment": "Malware payload (AdaptixC2)", "value": "189f79e15eecbce1169abff886d5ec22c5927486884d7a201077e69e333e3105b80a46de41840a24d1e5aa75c4cddead", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785240549, "uuid": "ce1d0062-d1e2-4e94-8c37-dc3aba74200c", "value": "T1FBC42C0B6D54F5E6C893917BF62369446FBEC0704284916AD0EDC080DEEB1E8CF5FA96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785240549, "uuid": "6b965e86-ef1f-4fd8-81ef-0acfdf318ba5", "value": "6144:IthcyNSYUIsOOmLZ8/qQcfVjrQVwgjRJwbkq2Xf+SA298OdpW:IsyNSYFsO5LSChVjywgjqZwmSAYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785240549, "uuid": "bfca837e-6a82-4a54-99c7-d9d0075adaa3", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785240549, "uuid": "5bfb13ee-33df-4d71-810f-126e321c9f73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785240549, "uuid": "1155829b-9d76-4405-9cd4-2cee78a5f5aa", "value": "loader02_cert_rc4_uuid.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702a71fb-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785211042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211042, "uuid": "87e77220-69f6-4662-98cf-74437bd8b6f4", "comment": "Malware payload (Mirai)", "value": "274bb7602e9cd8c374388c9089969ec2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211042, "uuid": "2a5bed38-bae4-4770-b541-1f963d9647cb", "comment": "Malware payload (Mirai)", "value": "d9bf072b4b23118a261b8f3c77823ff40d1d6eff02a51737cadd6d858d91ea2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211042, "uuid": "e0bfbdae-72b5-4178-a35f-ac33a62c21b4", "comment": "Malware payload (Mirai)", "value": "ecd730e1571e6eacf6e82c6da4e76a768c35ba3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211042, "uuid": "c1c660d8-c79d-4ebd-9ef4-715811b2927d", "comment": "Malware payload (Mirai)", "value": "47b0712a34ed7fd43f60e4a4f7a35d361b4b886ba53678b7d89ecae53100e9ae96cdc63e20e85bb0ce33900290309421", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211042, "uuid": "25fdd799-3884-46aa-be25-8fe0dfed1e28", "value": "T18ED46C5DFE5E3C42E3CBE2789A4E83E1B22BB294D32351E33982534C95C65E9CBB0551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211042, "uuid": "b3971c63-4257-4738-b99b-3f2ae7e01cfe", "value": "12288:YKCKizH5KARvshbTBBnpcYWnorFw5VN1dBr:bCK6cAuNp3udV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211042, "uuid": "7d39115a-1026-4c1c-83af-57e1ae6e0fc9", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211042, "uuid": "142421ab-81fe-40ba-b324-6132893815fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211042, "uuid": "d6cbf0c8-89b4-4338-9441-d2d57d242e82", "value": "bot.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9711ead5-8a24-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785202518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785202518, "uuid": "951518bc-fd62-4ba0-8b38-443389a36dec", "comment": "Malware payload (Mirai)", "value": "c52849e98dbc1b9194695a6bdb9b1a23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785202518, "uuid": "c9f779d8-de34-40cf-b251-b23967876ff2", "comment": "Malware payload (Mirai)", "value": "da8d5c07be1c8cc6bcf73f1d9d4794f3de6a8e8d5d873ca310c3bd366d8bde1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785202518, "uuid": "5e763d5c-15c0-4663-ad06-c34c0acfb59c", "comment": "Malware payload (Mirai)", "value": "2716312795e79e803de56493abc52230320e9fe9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785202518, "uuid": "2e27618d-e0dd-421f-8a43-8f6a22a1a917", "comment": "Malware payload (Mirai)", "value": "65edcd1f02f606307eb2f8000537289fc72ba4253eae2f7cf2bec94e002fec32ed1a3d36e45ab79653f35d206f2079f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785202518, "uuid": "23b29ae9-4f68-4a17-9164-2252dcf4ee26", "value": "T14B93D606EF511EF7D8ABCD3342B94B0634CCA54622A43BB53574E938B24A54F9AD3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785202518, "uuid": "e5335e95-137a-4090-834c-96442de2830b", "value": "1536:OaH+a4CLeTuLjkOTMVfs4q2TcrPjiQdNpDxQQouhqfN/Hal/n5ZLCTRrf:3eTF0iwPjDHpu0Fn5qrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785202518, "uuid": "fc190f60-488c-40b8-8fd0-ae66b55e3733", "value": 97140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785202518, "uuid": "cc16557e-8bb5-4722-83f6-7978d9572fa1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785202518, "uuid": "ded320c8-b51e-41bc-ab53-892d8c5985b7", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2918f552-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233257, "uuid": "4d0722a8-02a9-492d-a558-0c30fa3978cf", "comment": "Malware payload", "value": "03c13146efebfb6b5f3d839d866471ec", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233257, "uuid": "6c466585-a023-4d93-8c42-2107bce2eb11", "comment": "Malware payload", "value": "daa0d694a0c9f209479b32d5fc9d234a84fd5b8f98d7e819096aa6158f4f0988", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233257, "uuid": "bbd6faf2-afa5-4e43-b162-2a37ac5540ed", "comment": "Malware payload", "value": "090d175fe850ea2e35bccda4a755fbb07bbc92f0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233257, "uuid": "3837ff74-b782-4914-b67c-17889bab65a0", "comment": "Malware payload", "value": "3ad920572094600220238b647526eeed8db9c9db7e97a168a66822573346998b7d2eeb0cfe8122a64468c227746a417a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233257, "uuid": "5bdd29dc-2d9a-45a7-b504-cf487a2a4331", "value": "T1D052D140581977E6A7D11472ACE34BE8E9A44DE5F700ED7EFC2BDA4D297CC060D58C4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233257, "uuid": "0fb3d0db-7a69-408d-97dd-c015d34ed8a4", "value": "384:/1+QC/o9VjP7wrp3Q8VXFxWxqIlg+H5UCM:SWjza9wTlVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233257, "uuid": "681bf469-0756-4455-806b-04827d14de4a", "value": 13987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233257, "uuid": "f24fcc32-f10b-4285-9b91-9bc0dd8c4eb3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233257, "uuid": "18ab67aa-a2d3-44ca-aad5-0284a537946d", "value": "images_20260728_061300.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86e0202-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221015, "uuid": "3f898199-fd32-47b1-bfda-9c8b42db625a", "comment": "Malware payload", "value": "0b0622b9ffebc1a9aef585381deef69b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221015, "uuid": "a93e6408-ba21-43e1-ba3e-844de6b0acce", "comment": "Malware payload", "value": "daa4e9f78ceacfbc2836a28b3522169f7b4ebd68e4cde28790d65c7f46ab145a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221015, "uuid": "61944378-be61-48ab-8e44-824dc57c992a", "comment": "Malware payload", "value": "aee8d307f8382d7e84ee9ba0cb9f71305c785308", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221015, "uuid": "7580d8aa-593d-4bea-8afe-768b637adb04", "comment": "Malware payload", "value": "21ac527e3e431ce451f9dddb8000f0d83622015fb04b69e419ec73b36c21e38e455f3779e4882e84032ca123e4b1e51d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221015, "uuid": "855ca45e-dfdc-4fbf-aaca-b98b95aca50b", "value": "T18462D0D18A594C95C6E3877866275EF8C2E0D571DF060DCA20F9F0988FF3C08936C18A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221015, "uuid": "ce5f7daa-15cf-463c-a483-45be96ea366f", "value": "384:054uwy97FhPabaoLIWWSg1wBlLrYxqI4BMR4iS:0TXJoUWWJU6h4iS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221015, "uuid": "2e078247-e4a9-46f7-83b9-e4ea280c4715", "value": 14658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221015, "uuid": "eab0f233-d471-4d39-ae7d-80be945218e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221015, "uuid": "add952f3-39db-4b20-8dc8-70df008aa9d5", "value": "images_20260728_000844.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460bf1e5-8aa0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785255639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255639, "uuid": "e10f1967-cae4-4c59-bc72-59d6ef518d29", "comment": "Malware payload", "value": "29498ad0dd0159cd530a19680d80124b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255639, "uuid": "0afb5c63-f1fc-4d5c-93c3-e1fd844fdad1", "comment": "Malware payload", "value": "db2ebcef5cbb0073d08b639be6be73317070afc1f971678397c422a18070af71", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255639, "uuid": "3cad7c6a-4113-454f-8897-94785419db1b", "comment": "Malware payload", "value": "52b0b29c7145c4b65ec1b064d33ba8c3095f699c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785255639, "uuid": "18008923-b62e-4d6e-9ac3-c8e620968f47", "comment": "Malware payload", "value": "11a0575f6f357012dc559eaf0fec23449bd93cdd971adea1c6f231935562eb987946df481dfab67f4bfd6eb524898bcd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785255639, "uuid": "e4fbfeca-4abd-48b4-bef0-6fab524f4524", "value": "T14FF05E15F9059131495C7B352EA909B362040AE78C23EE13C74347AF2C46EA2E63EA65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785255639, "uuid": "daf46071-4286-4b33-92a2-67b70877978e", "value": "6:hcXeEHoktFLUJOKSZKA2M7Q5HEtFLwsPPWqOKSZKA2M28EHEtFLwsPdq6hqRyOKa:IeCoZsKWKA2ZFHh3KWKA2GCH3hR/KWKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785255639, "uuid": "118a4058-65e0-40e7-a37d-0304ab7be002", "value": 487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785255639, "uuid": "dc5bd1ab-29b8-4066-9a12-5f0b7cf96145", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785255639, "uuid": "fcd3de52-8127-486c-8fac-d97566750cfb", "value": "db2ebcef5cbb0073d08b639be6be73317070afc1f971678397c422a18070af71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aada2a8f-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221019, "uuid": "ef179ac2-9cb1-4208-ab34-44700a2fa992", "comment": "Malware payload", "value": "695ba46eb3a3624be7d9dd3ccce261c4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221019, "uuid": "ac550ede-925b-400d-bc93-d87e5f38de5a", "comment": "Malware payload", "value": "dbcd5b292e21d0036f686873707b747750b41099495ac5bdfd57963debc29403", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221019, "uuid": "7b43492c-e935-4808-9c58-3a95ec240baf", "comment": "Malware payload", "value": "75309d8be3d829bc7d94f9712dd31b795b4c6fde", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221019, "uuid": "2c8ac9dd-1990-41a7-a779-8a5a82f44a78", "comment": "Malware payload", "value": "2daaaff5213c5de934c1d58e85403799632ea85690439df42afee35b12451b7610bd8ae01973a1c86f355f436e536143", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221019, "uuid": "238716f5-64eb-4d0d-ad02-4485ed4f45c0", "value": "T10D914CF9936D9500C52D9BE995F35FE4F19811CE49007D5EA2C9D26CB62A0C0CEDF1E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221019, "uuid": "20a828f4-9f05-4093-8d46-0d467c761a37", "value": "96:FmMBzeD4tyKj5eVV4navyWxdz04D8x+OjO9pJl3Tv2hK+:0MBzAJcnar7zNirjGpPTv2g+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221019, "uuid": "56fe10df-1f69-4cd0-a214-9dcd41aab19e", "value": 4325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221019, "uuid": "ecbdd254-10bd-4fee-a954-5bb39da8e59b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221019, "uuid": "b14715d4-8e85-40b6-9972-266cf570b807", "value": "images_20260727_064429.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05487d9-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249778, "uuid": "97faffee-8572-457d-84d6-6fc16ba95d05", "comment": "Malware payload (Mirai)", "value": "729666e5388483e9e188691ba9042ae8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249778, "uuid": "e67ed5e4-2062-4d33-b1c3-c03e76683ffe", "comment": "Malware payload (Mirai)", "value": "dc7c3dd3e5db88d89d977e4ecb4bdcb644e83090e64dbd486c9961966c4c6165", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249778, "uuid": "dabf43d4-aa2d-4fac-b5b4-428b08eeb9ab", "comment": "Malware payload (Mirai)", "value": "64f7f525188c05458abd1faa3974b21ec27fe681", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249778, "uuid": "18ae8cf9-db7f-46af-931c-f2b5eb634510", "comment": "Malware payload (Mirai)", "value": "f361253aad19384bf3f47d1a43c6d592601f15930314494bb68c7efcc81fa1bc710813c9a8681c00a1906da26ba780e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249778, "uuid": "b7408554-dc71-4a9f-8de3-ce08c8e2a65d", "value": "T189F32C86BC808B12C6E151B7FF4E428D372647ECD3EAB1079D196B25379B8970E37612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249778, "uuid": "d11ad662-e3ed-4ae6-bf97-565bf29e6ac8", "value": "3072:CdjCFeDm6P2G0SDI7BQwCU4wwF4NIwc7OMvAR:CJUu0SU7iwCU4wS4NIwcTvAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249778, "uuid": "7583268c-1b03-414d-a6b2-c590ec10006b", "value": 166464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249778, "uuid": "18c91384-c45b-4b0b-b3c0-f1bc882b507a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249778, "uuid": "d18d7990-9089-4536-9847-f9b19830af2c", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57db585f-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload (DDoSAgent)", "timestamp": 1785224316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224316, "uuid": "ed0b2a38-ebbc-4835-b5aa-f89ef898b373", "comment": "Malware payload (DDoSAgent)", "value": "1895e618b218ad26175c61bc6f3567e8", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224316, "uuid": "cce9b2a6-f414-4b28-8d3a-4a8b8cae352a", "comment": "Malware payload (DDoSAgent)", "value": "dc8ec4b8134a15c798d11f7d492c7ca9bde068a0e497abf5dedc3b102402db34", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224316, "uuid": "01bca99d-706c-4587-aaf5-5af98cf54930", "comment": "Malware payload (DDoSAgent)", "value": "abd5c451e3b147d7a3860fb19aef53bde6e6c0fb", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224316, "uuid": "36328f21-7d4f-4d38-a36e-95d52616b600", "comment": "Malware payload (DDoSAgent)", "value": "e7976ca1c2bd4eade1af7b4f0d230ad5c1e1c0b0cae42f02af0dfefe70a9900a1997f007583d3aa53f2242e50960e4e5", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224316, "uuid": "a735b05a-fbfc-4079-b58e-a651483d870b", "value": "T1AB55331695A5E360EDE737344CBDD59AD79220C84A274D305F0EB623A37E047E32A7B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224316, "uuid": "2f3d6d77-880e-44df-a6bc-d97227443fdc", "value": "24576:NipuZo73lOHItxsKIZ/34aKpwKFQbqTd0mBiY8Gv+E8aLGz:Af78HuKKav4VjQE0nzIvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224316, "uuid": "818cbddc-48c9-405e-9073-5fff93863bfe", "value": 1298024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224316, "uuid": "c0ddada0-6c1b-42f6-ae71-4ed916a433c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224316, "uuid": "0b9f4bf5-747d-4a89-adfa-0dc9c84314d6", "value": "devfreq_wq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c1dbc9e-8a84-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785243704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785243704, "uuid": "71000956-cf81-4620-b144-5bbe8343c975", "comment": "Malware payload (CoinMiner)", "value": "f8e97b3d0e4335fe86255cf198663149", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785243704, "uuid": "0396cf2c-e453-4c2e-8229-ef30e6ca7599", "comment": "Malware payload (CoinMiner)", "value": "dc907a7b5d67117a35298a23c57df45549b96937f90bf067ac792b32c97edf76", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785243704, "uuid": "8bb6c1b8-daa0-42fd-a547-e4e627f32d7e", "comment": "Malware payload (CoinMiner)", "value": "073a09889bbaf599cb36843e1204b059f5e43b06", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785243704, "uuid": "8d79ff19-0c79-4010-bd72-510e12c7546a", "comment": "Malware payload (CoinMiner)", "value": "fef36b9e8805d76a53cb65eb73563bff9951965293ec75627b8caa53cf9347b9e14ff2d5603292730e9bf24dfe634b99", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785243704, "uuid": "413132c2-77ee-4ef1-a757-2f9e3322da3d", "value": "T19422391F7E890231E39448B4257A864F553D1233A783B3EBF773E19D0B953498840AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785243704, "uuid": "62264356-b0da-423b-bb90-c2fc6023b4e8", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785243704, "uuid": "27c31702-051a-4db6-ad75-48c0865e4772", "value": "96:hAwdfnoeYz/J4hrt6KBWdCZaDbFx+ZQKl6ETZjH/CPFJxGE9mZ2FFhxC7tCEe/z8:WwoNScKB6x+eKlKPFJxTEZmFhSer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785243704, "uuid": "d9ae9dc7-92d9-46f0-9334-1ffe7fb99fec", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785243704, "uuid": "9d763025-55f0-43aa-bf27-9b0fff14e2cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785243704, "uuid": "ad72ba90-bef4-4d25-97e3-4068bd61726b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0547e13b-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785224178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224178, "uuid": "c6f84ba4-f532-4b7c-93b9-50ede3cdf058", "comment": "Malware payload", "value": "d47cf7664bcd029293c48f36e6b07a2d", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224178, "uuid": "a10d0a2b-95ee-424a-acb8-26f2a8a50014", "comment": "Malware payload", "value": "dd178cf3a3d21b70053533f302572e4699e98a45b029a0662d253d5cb13d1135", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224178, "uuid": "8408b480-d303-453a-a01d-eeef85021bb2", "comment": "Malware payload", "value": "0dcf50c52e7c68e2f26f96c8cd86402886f7692c", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224178, "uuid": "dce7f99d-c1ac-4214-9cec-ba543d6b292e", "comment": "Malware payload", "value": "6ec77f3be610bca7948ec0f9db91c61b4e963930415267b09f63b5a7bd62b1e038a442ad3651462f2025e158cd81abd6", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224178, "uuid": "7376eeb1-fba3-47b9-a78c-e2b84d8ab67f", "value": "T1FD51D91AA3E8466BE4770734AEE3075737B4FC109FB757AD19800229AC60B545E32FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224178, "uuid": "f1c391f6-2987-4917-ace7-4bf59f3edf64", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224178, "uuid": "e7735be4-07c4-47f0-913a-2c7610ee8ba5", "value": "24:etGS3/BepOEl/d8d7itoK2ltkZffmZ3HUWI+ycuZhNCakSqPNnq:6QMUuMtorQJ+RH31ulCa3Gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224178, "uuid": "1927a946-72cb-4284-b7c7-63e4b784ea94", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224178, "uuid": "cfba5444-6015-4835-89ac-51172367fb65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224178, "uuid": "3852fcc8-e631-4500-8ac8-93aee7b8c927", "value": "jyfdzqok.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc15951-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221049, "uuid": "7f118d90-d183-49db-bb83-f1954aec26a5", "comment": "Malware payload", "value": "1caa7b1550c158ae8a708de1362fecdc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221049, "uuid": "6b56cb6b-1497-4306-a4aa-929e83cffa6d", "comment": "Malware payload", "value": "de31f95e46b82bcd52b11e42b3c5e6e034e43c3f0d15b024b1ddab373a4e6515", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221049, "uuid": "7761d829-cb33-4ba7-8bb5-08126a52f9dd", "comment": "Malware payload", "value": "a86f8747c957e315dcfb6904ffee4eaa483f34af", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221049, "uuid": "22373e7e-6e65-43e2-839a-a291ed34df3c", "comment": "Malware payload", "value": "938fb065dc1ca96a308d4d7014fe02f5d86400259106b885e6f2cf29f99fe203e0c7e79a6c0730a25d250c121f4d25cc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221049, "uuid": "ea713e1c-5515-49ff-9af6-c9a50b113486", "value": "T1ECA1AD47416A9420C11827F060C09E8D9FFDB5E66A302D20D4AEDC6E063E90E9C4FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221049, "uuid": "83cee05c-4e07-41ac-a9e1-5ed98d370429", "value": "96:6FV2DRM0PAtnnvz+uHzA1J150+ouWVY46CDfNQMC3SmjjLRz7trw:699quHkbtOVY45rNcpj/R7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221049, "uuid": "929684d7-5113-4e41-9765-2e258cea1e22", "value": 4902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221049, "uuid": "8f631f6f-a8a1-4c6a-aaf7-159083f92a48", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221049, "uuid": "3963112e-6e84-484c-bf03-c53f9f00db4e", "value": "images_20260727_085214.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c031403-8aa5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785257770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785257770, "uuid": "072e0ed9-4c54-4b7c-84b2-9e51209418b4", "comment": "Malware payload", "value": "807c16ccff2e94203d10f8ad6f6c57fe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785257770, "uuid": "85cd12f7-0707-4854-8b81-be01bed6163a", "comment": "Malware payload", "value": "dea1847c964c08cb6bcbddca7fd3ccffbaa3ce8c0989fbf5717b3c93e5506f47", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785257770, "uuid": "fbcfa037-13fd-4880-a3bc-2734c8a18110", "comment": "Malware payload", "value": "a531c9b32831b455e2abb52bc58e25bf0147611e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785257770, "uuid": "63818009-4047-450a-a27d-134d028f56fe", "comment": "Malware payload", "value": "3fd185c4e5918933473f3bce0b7f554a2344404e5efd6fb38fb44125e43a1f548bb1992dd7e77038e6ea186cb3584848", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785257770, "uuid": "eec48f5a-733b-4394-a282-80243790a219", "value": "T1C2575DF6006919B28005FE1E79D5E33648E884DA0B16ACFFBE5B1DE675B884C041F9F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785257770, "uuid": "5741607a-af34-4bb9-bf19-9a6ed0d2c05d", "value": "768:Ft/fTuTja6nw8naehbBhgsmYmwqDOvLFyoPR6jG8b7fhrGW3qY6Og8UrRorOt1BJ:P3OmUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785257770, "uuid": "fb94f345-a571-43cd-9242-0f0c21671c4a", "value": 27462070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785257770, "uuid": "e47e1eb1-ed94-4894-ad8c-d9107832a210", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785257770, "uuid": "bcc294d6-7259-4e9a-9d21-e46732734421", "value": "FACTURA ELECTR\u00d3NICA DISPONIBLE PARA PROCESO CONTABLE CON NUESTRA ENTIDAD BANCARIA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb87d365-8a21-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785201371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201371, "uuid": "1b6df448-1ec2-4aec-afec-d1e8d6d1d4de", "comment": "Malware payload (CoinMiner)", "value": "8451ef00301b20b84bee633be00369f6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201371, "uuid": "23f91526-d693-4a43-ae57-885dbaf017cb", "comment": "Malware payload (CoinMiner)", "value": "decafa3d6023701eec07d0d0f1ac5b8070a47bb979a5d18d2e70296e51f1e2c4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201371, "uuid": "e47195ae-65f1-4111-aa6d-236bb0cc5b34", "comment": "Malware payload (CoinMiner)", "value": "4eb7075899aa2eaed9ba03322301f1d78a89bc76", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785201371, "uuid": "2e6d774e-6416-4dd0-9452-3bf9aebdb50a", "comment": "Malware payload (CoinMiner)", "value": "9d9656d0e150bfe08c48c57164f887c023927d4e5135219152f5f69ecd89cbad5db51e31817bee9e1b0205af65dbb250", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201371, "uuid": "5e2c2a3e-99ae-4b8d-9b17-164810071317", "value": "T193654C06B6A744BEC0F5C430874BC5B3AD35B8546225397F3695AB202EB7E204B6DFB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201371, "uuid": "7f9f56c7-b408-4e3e-88b8-003feea10711", "value": "24576:2sGzXMH2HZFbM9OGXTYu9BJZjGWSsiYbk2TW+5EIDR:2s6XMSPM7Dp/GWjiakgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785201371, "uuid": "f39b694e-6ca3-4784-81fe-fc8f82bd82ac", "value": 1516416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785201371, "uuid": "75711dcd-220a-4124-9acc-d8830fe04710", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785201371, "uuid": "ac5865ae-0d57-4b12-bc44-7c3af799e357", "value": ".X0-lock_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ef8570-8ac0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785269631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269631, "uuid": "5d240936-8a8f-4149-83eb-06c2c676f848", "comment": "Malware payload", "value": "9deecb8f9c95ae0696c0758f8fd986fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269631, "uuid": "bf187144-44bb-43d9-8d32-4f0e971e80cd", "comment": "Malware payload", "value": "ded67d13db4b33119436c67e94142e5e903ac5c7dbad6e98274914dc0f8d6182", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269631, "uuid": "67fcebc2-5e64-4f76-99ef-037bab8aa8e2", "comment": "Malware payload", "value": "77698accd857c188a127aac8088429e6290c0e4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785269631, "uuid": "e149f944-e1db-44e4-a409-6d1d742c2aad", "comment": "Malware payload", "value": "03455cac5f1de8de0f8898b51b81f8cf8509277d8d8216e19237dafaa100b2575ee7dd28fdf982297519754858095e47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785269631, "uuid": "0a9dfc94-1574-4b1e-a69f-8686cdd49e38", "value": "T157532B9AF801CE7DF85BD77B4457090AB532B3D112831B3623A7B997BC731A81D22E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785269631, "uuid": "d61876dc-cf59-4321-9327-a492b45541e4", "value": "1536:m7Eg48H4K+3a38/yph8Ci+HaJEc7DnbaNmMaW8YOi:m7E98Yl3a48h8mHwEcfSv8YOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785269631, "uuid": "09d74ca8-1f66-4419-8b22-3286ea88d914", "value": 61700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785269631, "uuid": "f42b6de2-d908-4450-ac7a-2bbc85ea7508", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785269631, "uuid": "90232f47-8457-431a-b9d5-aeec1a94afd9", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "432cffe0-8a4d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785219986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785219986, "uuid": "eda3f538-b52d-45bc-ae4e-cc1ddbe15ec1", "comment": "Malware payload (Mirai)", "value": "eb74def85aa66b4a752b4629cdade2f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785219986, "uuid": "4f356c2c-45a6-4b5e-bdcc-67c0e5cc9818", "comment": "Malware payload (Mirai)", "value": "df3978ee0be49d294f5fed8a609f4bba87d17837b838670cc1214a99d69a361e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785219986, "uuid": "fa83337a-0b37-4953-a138-c69989ee32f9", "comment": "Malware payload (Mirai)", "value": "867602aba3aaa8b1b1b7c515ec9a501fa4663d59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785219986, "uuid": "b326755b-efac-4c24-b931-aae632a62a33", "comment": "Malware payload (Mirai)", "value": "3e37f0e9a0e2512e9facbc7174e81eea2e30f4ca100d07a9e2712ac95ecbed73bb38afd85ecf1015c2860101be602ab4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785219986, "uuid": "f61e5851-3183-4029-9a3f-92fe2314c16b", "value": "T1DFD46C02EF841FEBC4AFCD30856E835715ED999702D5A63461BC8D5CBA8E25B0FE3498", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785219986, "uuid": "5e526112-59e3-47d7-b08c-39d47dd8b3c0", "value": "12288:1ZHIo0OBwfg+J9vjLC3zNdoE9R9dzl2NwlvF/DCv4yj6JgMrOpOVfm51yD1ezubS:nfBwfgg9vfoLfdR9PJbHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785219986, "uuid": "805b63e2-125e-4243-a523-627e53380187", "value": 598204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785219986, "uuid": "4e3477d4-656f-4f9b-abd0-149b41ceae6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785219986, "uuid": "db5ce46e-7227-4c6d-aa62-37f8e6f627d3", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816b5031-8a51-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785221809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221809, "uuid": "e90b5872-8f0f-49d7-a662-b3c87224b492", "comment": "Malware payload (Mirai)", "value": "58aea905ce637062d9ff8208dbb30912", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221809, "uuid": "5fffc931-d5e4-4d67-8a94-74946528d474", "comment": "Malware payload (Mirai)", "value": "df6d0faa401f1dd6920c60b4c5a3ff456860edfa1f971555eb3390040a671b5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221809, "uuid": "c5b2cc5d-30f6-4c5c-ae1e-c49a7b527fd1", "comment": "Malware payload (Mirai)", "value": "015ee693f285ce22f43ba65aa0673b82ea5cc388", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221809, "uuid": "e35c973e-6c2c-49f7-b85f-d9fb9db0ed22", "comment": "Malware payload (Mirai)", "value": "b858043bdb6dfd331fa27dd282b15ce0743e7a922932ed72dffde57fc838a8f49f8292fdc0d07b001a2f8d25198c30b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221809, "uuid": "b0689dfa-f4ca-4e06-991a-33e32df61b66", "value": "T1E263095BB9819F15C5C1167AFE1E538D33132BBCE3DEB213DE146B642B8B46B0E2A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221809, "uuid": "b815070f-16b1-4fad-97ee-c9cc5ede279f", "value": "1536:X+ntMmpccj7U7kBWvNpIcqAKEx4kbAkEiKUCtJEEEOP3yLfhia9d:wMajYVIfAzx4yEUCtJE+P3yLfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221809, "uuid": "73517f6b-d2ca-4a70-af63-1f30464958d3", "value": 67432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221809, "uuid": "a32517d8-9d6a-4bb3-ae26-9a84c58f276c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221809, "uuid": "e8b11276-7fc3-4c13-bc99-91e8abc30f16", "value": "Xvg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760af7a6-8a92-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785249707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249707, "uuid": "dd4ae6e1-14e0-4115-9559-0648a4e4bc47", "comment": "Malware payload (Mirai)", "value": "d03e53f92f05a87e01761054dcbae73d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249707, "uuid": "5c09409d-6072-47d4-ba0d-7f3fbad4f31b", "comment": "Malware payload (Mirai)", "value": "dfac3a125d6cff7282677c437f170cd6195935ee5b247f575559af481b560d42", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249707, "uuid": "b39acd65-6026-402a-9dba-bd5327e1e6a6", "comment": "Malware payload (Mirai)", "value": "0c3eab6190ceba2bde902bd9f0b25913278d8635", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249707, "uuid": "ba7c4ffa-1dc0-42a2-8c6e-a57c5087cb95", "comment": "Malware payload (Mirai)", "value": "434781ca30a655e52552bf7b454ce9ce5ec73f341c1442683b171d2c897524ecbffa92a66019f3b0c39f5dc28d7d3264", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249707, "uuid": "0ee304a1-3607-46b5-b253-0a2d3893736d", "value": "T1FF3302A0754A25F0E6330D7671743A46F277C72DBAAF30B1004286149AD8A0FF4F85BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249707, "uuid": "167f5a30-b3ff-43fe-92c6-2156b7a82ad2", "value": "1536:lJ8aDdPU9y3K/1fHVkg3HBv0adgNW+N+1NMzB:waDFlG1fHVkg3hvLdgd+vM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249707, "uuid": "74ef1a48-9968-47f0-8ecc-2b2d506dafd5", "value": 55040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249707, "uuid": "50b53a35-f933-4eae-b5fe-2f068d50f90a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249707, "uuid": "9c605399-9390-430b-bfbb-8e02509c1e0a", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b67681-8a4e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220450, "uuid": "3e2364cf-1f3c-4365-af4f-d6744d7bb9a6", "comment": "Malware payload", "value": "e5530901c36ba92bddd3a90b0f9bb561", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220450, "uuid": "4d0f45d8-8112-448d-8ff8-dbed23a125de", "comment": "Malware payload", "value": "dffc6628efae94aa3d6bf395daf2c3aed58320f351d2e7c9ea487a496f1b59fd", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220450, "uuid": "5c13f381-a083-450a-b71d-2179f42103ff", "comment": "Malware payload", "value": "72619238cff245de63de473ab88f00768da0c359", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220450, "uuid": "28da7274-09b7-4cf6-a16b-abda9f2d45d1", "comment": "Malware payload", "value": "19c51cf9bba70797756880d8bbccbe98919565936d48f771f84c1a14403aa92924cf540043dcc4474fdc687af4689e4d", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "reservphotoinstaynow-shop", "colour": "#DA98F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220450, "uuid": "d102f905-84df-4e37-8eae-b71103183850", "value": "T11512C0D352C344015BD3447C30EE4B0CE0A9C69321C6B41B4E1F217EBE196FD4D64AA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220450, "uuid": "1db2d914-bb51-41d0-a17c-c3a258bbb4c4", "value": "192:aWO3aDBxeBzM/PF8dsPD0rrtqud88Civ+J2JlaRZqeFxRvN:qaTeBzO1pudMiWJ2jaqeFzvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220450, "uuid": "9ef03bcc-1853-4c92-afd9-aa64c568050c", "value": 9558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220450, "uuid": "0991f0aa-e757-4f4c-ab2c-0c09e7dba916", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220450, "uuid": "5bf2779e-bbe6-4b06-9eab-179c77d0ec76", "value": "images_20260727_231922.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ae6e2f-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233201, "uuid": "a4dc8282-b07c-474e-a1d4-1b5418b380c7", "comment": "Malware payload", "value": "99408d7833541bbecf70daf16ca30a9b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233201, "uuid": "7e5f27b8-4a40-4343-8be2-760b055baece", "comment": "Malware payload", "value": "e073703abc4e3cf3609134e28f440e824b9a7196712ff128e222771269ade4a5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233201, "uuid": "fe3174ad-7f7d-4a0d-91b0-822382938ebf", "comment": "Malware payload", "value": "31d0e95f56766d4dcd583a3f1770080ca47a336d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233201, "uuid": "4ef024c9-1f92-4f6f-9b6c-8d19fccbd2c6", "comment": "Malware payload", "value": "106fefd1e230603b1513719bfb597405979b544816f89120a4e02a3412e64616095afc362dd8a5789692c785691e774a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233201, "uuid": "c1e35dcb-6e6e-4eda-908d-c0b0fd0e702f", "value": "T1E741F849D616EA9DEDD772BC75E23C89502811CB03AD004E30BF1E7821DAC862B4EA78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233201, "uuid": "72e1476e-06f7-480f-a848-776365e7cf1e", "value": "48:9xOWkDtdCHR2v77aYvriTFRN9bIX3PAsRmUJilvmOEk9:idCH87aYTs9/sR/udEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233201, "uuid": "54c09600-b831-4cfd-afb1-25813f1cae0d", "value": 2303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233201, "uuid": "a9e05be0-3427-457a-b2fa-085979887d67", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233201, "uuid": "b3c240d0-6944-450a-a8c7-194050a0f115", "value": "images_20260728_084749.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393492dc-8a8a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Herodotus)", "timestamp": 1785246169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246169, "uuid": "84ddc829-cb45-46af-abd7-dc287de2a67f", "comment": "Malware payload (Herodotus)", "value": "7a5cbe43a924133ad5eb842a7f8a3ed4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246169, "uuid": "fdb1a710-a268-4003-a750-04bf9cd6af7c", "comment": "Malware payload (Herodotus)", "value": "e084a327fde5523b1803040fc1ea40be84bc8434913d37d01083890c351dec96", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246169, "uuid": "da09fc2e-2b41-44fb-b40c-132d8d145ca8", "comment": "Malware payload (Herodotus)", "value": "373b74b1e7d9ea544f066cd83a9369a430efb572", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246169, "uuid": "41fa8334-2865-4cd9-8adb-bb06a5ceb6a2", "comment": "Malware payload (Herodotus)", "value": "8405b3381479b15d2e3772ee8d4bf3a51af809adc31bc104dbca8c55bda67d41ac3f7f5fbb436c645244f44934a15eec", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246169, "uuid": "47c32081-b9a0-4a2e-819b-0584f9600f35", "value": "T1D9B5F117E6A10F63C47D813919B623606332AD1C8A43B70BA448B3BD7FB36D65B857C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246169, "uuid": "bedf8761-bd84-4dcc-b48f-b640dcdc1d2b", "value": "49152:qaae1dfzEmEGUq9ZWPF4JlU1hHbxoGqx/6y1BlnQzS9ldmG:PnZEKZk4Jgh7xKxictZ9ldF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785246169, "uuid": "654005fa-c491-44de-b0ec-9d9276010bab", "value": 2386589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785246169, "uuid": "e2632a81-3eb2-47fc-8797-5b71284221c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246169, "uuid": "061d88a1-fac0-4f67-88e4-805397ead618", "value": "7a.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f11afb6-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785224436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224436, "uuid": "e4622424-6488-4f7c-b957-eea9da3e2865", "comment": "Malware payload", "value": "73126ebdf2efc6de16e2e7e5a286c892", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224436, "uuid": "0f6eb05c-c5ae-4426-8748-fe33cb917f45", "comment": "Malware payload", "value": "e15d8c889faf0588ca9679414c588588c546c5c71ce0e167a6dce2482817b42a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224436, "uuid": "2aa03e7a-179c-4d74-970d-6d59bdb7c5eb", "comment": "Malware payload", "value": "6bd53af2aff7e10d2867aa5ec50901810e750f2a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224436, "uuid": "f7b22d7a-5f89-4ad7-ab13-f278a939be9c", "comment": "Malware payload", "value": "7b2a12ac270fad41b679af0e3cacee6249cfb489770c6d043ad31066c851be987bc4495070863797bf22dfc962a3b63e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224436, "uuid": "37bf5d2c-3f2f-4ed6-8ccd-2359f60bc0f8", "value": "T1DD65332710E7A9BEB270F128AB4A5A5BC84D0537B5E7763D09780ECEB9DD48DB15C340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224436, "uuid": "a5f563be-e8ea-4c6d-abba-29fbd151c888", "value": "24576:WnAMgJz9GIbtfp3EnM5BHYspq29vMKjZ7IBjugdoePvD6Teht4+pOKAVloo+s5o6:9MR8tfFEM3HDpq2VMEZ7I3nIUUVloo+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224436, "uuid": "6996ef37-8f0f-4307-95f8-46348400021c", "value": 1453892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224436, "uuid": "a1e4c845-b652-4c88-b7c7-35f6ddeb1896", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224436, "uuid": "b4283896-ec11-43b1-9684-41f15cb06d2a", "value": "ksoftirqd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce9321c-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785211198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211198, "uuid": "cd20144d-9060-4aa3-a79f-092bf422ad5b", "comment": "Malware payload (Mirai)", "value": "a02febe62a44d81d914532890580e9f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211198, "uuid": "aeb25b8a-1602-4dee-a7f5-11e9ab300142", "comment": "Malware payload (Mirai)", "value": "e1826d050e3ea1f9cca6da6f71f25ec75ec55671ac15a838845317ed6e838f32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211198, "uuid": "cd45014b-4bfb-438a-afa9-799b41a9a671", "comment": "Malware payload (Mirai)", "value": "f310a249475480dcd3f55393f738c6eeeb93689b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211198, "uuid": "71dd2ef2-538b-43b3-b85d-adde5a3982a3", "comment": "Malware payload (Mirai)", "value": "8cf53b09d0c9cb0e984db3ca1595ee08f3294b8c00619b9c9771465d68630078a6cc67fb2fa3ebea9071e55e4455a780", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211198, "uuid": "88e945db-5f34-41d4-a69a-9a6c42ffeb18", "value": "T14FC44A56F8809F62C5D1257AF65F8268331347B9C3DB720699189B383BE386F0F3A645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211198, "uuid": "40571db0-33a2-4193-ad97-ca70924a8ee4", "value": "12288:WAfIQpkZBxUA7UTCC2/Dr6kWiC1KgpMsx/YuPfjSBbNkHP:WAf1k+A7UT036tR/nPbabNkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211198, "uuid": "3b1a4519-6dd0-4fcb-b5a5-c703d2be7b7b", "value": 549028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211198, "uuid": "72e8a334-5c6f-40e2-b4cc-94dea1721d35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211198, "uuid": "999a0741-315e-4ebc-8451-58721e4eec09", "value": "dlr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42423ea2-8a96-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785251338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251338, "uuid": "a6303723-5ee8-4c37-a7e0-1091907d3387", "comment": "Malware payload (Mirai)", "value": "8d47d4512ac83befab4e32681c7ab5fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251338, "uuid": "aa6d0835-3373-4f28-a45d-742331ea3120", "comment": "Malware payload (Mirai)", "value": "e1f11070416aee5237a2bd0bcfd0aa966e0f0d6893b4684f2d88b4e56b630109", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251338, "uuid": "203cc4ba-2778-488d-bee4-2d25f3d081e6", "comment": "Malware payload (Mirai)", "value": "1a817d56b49a5698cfc459eb991d75a16acf35fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251338, "uuid": "225f9c4c-69fe-4aeb-b834-8da576d32d0c", "comment": "Malware payload (Mirai)", "value": "5984166ecb5c93a2c788e032e1dad2a41e96f976c1ca4c62b1ac77f5d0297133f0fa3b99e951982bdbf5a9305bb08c1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251338, "uuid": "172227c1-4832-4145-8df4-b84f6596032f", "value": "T1B9F3AF97F307A050C8E04AF92BCF5BAD293721018E2B99E76D6E733616775DB18063D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251338, "uuid": "e4d455d0-c2a6-4e4b-9e5f-3a0d775b1ab2", "value": "3072:uESWdueXfVNNjSQq/46EiC4keI7Nr0Kq26XghCgY2Dj+rZq:u1cueXP9gEiTke6OxxkCg1D6Zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785251338, "uuid": "78b7fc77-7f17-40c4-a6f5-22810c88bc39", "value": 157336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785251338, "uuid": "c8611fa9-19d4-44c9-ba88-dfc2d0469d5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251338, "uuid": "b3eda0e5-a28b-475e-a274-9778906ed959", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca737ef-8aad-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785261153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785261153, "uuid": "ef55d0ce-b6c9-4a64-b465-f9b588b02c37", "comment": "Malware payload", "value": "2904c0f521b413fec9903435f6b5e3b6", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785261153, "uuid": "eebfe62f-3b6a-4532-9066-ba6916d80132", "comment": "Malware payload", "value": "e2285fd2c1e26a1d394c23a73756f71540e2b9d78486c9f4f67d1fe3a370500e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785261153, "uuid": "73be8e1d-9ea9-44f0-8d8f-8847b99574fc", "comment": "Malware payload", "value": "fed5adea5763161422d144116e8d2c3e31bd68a6", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785261153, "uuid": "7f7bc226-1d00-490c-8a1a-1fc5cfc59842", "comment": "Malware payload", "value": "84e58a79e66bb8004ec362667d58c96992dbb89ce00a29ed1d6d437596b04e08b68e3751ba08d30e4e7540d03a5b43ac", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785261153, "uuid": "b1251005-5731-405c-aceb-de126cb00e62", "value": "T1DCE633083AE122EDE6B3503CC8F11956F6B674A50730C59B4BA8C3A5BE531D1493EBA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785261153, "uuid": "243a4344-59a7-4e54-a96d-2ef0c82d3194", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785261153, "uuid": "25eb6b6c-264c-41f5-9eea-1074d94923b1", "value": "393216:Q2vBe9TNkQm5yP7eKiMYxRG3+FjZSXMCHWUjX8cuI3/PGTAI:/JQNk1wTeJMRktSXMb8XpH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785261153, "uuid": "53aaf26d-01c0-43d5-8eeb-6e8f813a0e22", "value": 14321151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785261153, "uuid": "be1ed9e3-377e-49e5-ab4a-c41ef88ad3b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785261153, "uuid": "0189de6a-51a2-4bb9-98ea-d247a4481792", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72903164-8a73-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785236387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236387, "uuid": "b6cc7130-0716-473a-9df2-1513bc882df6", "comment": "Malware payload", "value": "6816c8dfdf10cc4ef2a074b117ff6c56", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236387, "uuid": "43e527ea-8493-40e9-ac1c-c9758bb6d2fa", "comment": "Malware payload", "value": "e282912432ea0c44137093d4633a91582c9eb3da56ac7fe5e235a50938d7edcc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236387, "uuid": "6512cec1-2448-43cb-a42c-66d8bf5d8a15", "comment": "Malware payload", "value": "2b879ef7fd68de6292b0cf525ec4a23f560da8d4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785236387, "uuid": "41765224-cc39-43c2-be90-66d796e3b1a5", "comment": "Malware payload", "value": "613041774d0f73d9de9d530e91fdea15bbb8c5427c9040b39a7e4555fab278d79c8a43fa4763f2c4c6e103912bbbf421", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236387, "uuid": "7c011a51-59d9-49e3-9036-695df90c8b13", "value": "T1C9C28D956A867C44BEC94A3E4CBD2B0D6DF5C3D1324942AC3D8A3C71DC11FACD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236387, "uuid": "7be09311-4b0e-4995-8165-639e8e0dfd17", "value": "768:Z/8vCB+25j6es8RKU9FYpMSUpi+20qUpi+20YQX:Z/8l25Jjd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785236387, "uuid": "33337492-6832-42d8-853d-a75f97ab4035", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785236387, "uuid": "636e0aed-5aaa-45c1-b0c0-3b542179ffb4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785236387, "uuid": "afa9d2c3-9adf-49ba-90aa-c0ba907cbd16", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0dff064-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221083, "uuid": "98b56b42-0493-436b-addb-065b1a855b02", "comment": "Malware payload", "value": "ad2b1beb5bf4ad1ff4dc2e30cc07e9a1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221083, "uuid": "48672f62-5a5a-4538-8134-02d6cd8b487c", "comment": "Malware payload", "value": "e31f6128d41b0844d33d104bed9df11c3d4e08baaf210d920222ada2f4796a18", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221083, "uuid": "532c5189-ec2a-42da-9a20-4b77cff11978", "comment": "Malware payload", "value": "ae5252900745bfe91f8816bae38d648cd563f23b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221083, "uuid": "930fe543-c825-46d3-bb0e-178068ffd0fb", "comment": "Malware payload", "value": "6846616d1a8762f8b27b145a2af1e3ff125fa0b40a7d113a4297b86bda2272553d385c1772238a007a70627d809017ef", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221083, "uuid": "fb5645e0-78f5-4a25-9664-1d64275f0559", "value": "T14B32C0C9EA4B85F7DEF21834B313BF18F9209650222196A9F30C69706CB19FE900165C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221083, "uuid": "799e166e-c3da-4bfe-a9f6-0a442c1c1563", "value": "192:/pbA0ihTybRGKO1luB41kMvvRK+/GAp5Z5a+Mtvwm3nchrzZFaXTb9oiq8gEJGFJ:/ZAdGjOW4n0++i45YnuXTpoi10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221083, "uuid": "fe681262-a905-4549-a2fb-4ff4caf8a019", "value": 11033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221083, "uuid": "4af61126-e178-4e0a-802d-b7fcbd83bd77", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221083, "uuid": "4851fc82-bd69-40c0-877c-6fb223cf8efc", "value": "images_20260727_203842.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5bc507-8a4e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220705, "uuid": "70a51ae3-2633-4714-834e-3ca934ab5ed0", "comment": "Malware payload", "value": "45748186b836cb582a297536b4d24724", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220705, "uuid": "eeea4116-e326-4d23-8518-3ff1e5626403", "comment": "Malware payload", "value": "e343ccff4102f402474eacf9d39be6ced4741fed4247b6ba37c9e759a6010bc6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220705, "uuid": "a0cda4d3-88bf-467d-a502-a35f592c13e2", "comment": "Malware payload", "value": "4cc0be9c72d76c75710cb7db6b29627ea9ea4067", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220705, "uuid": "08027f3b-c98b-41dc-bb50-d619d3f70c21", "comment": "Malware payload", "value": "cfe140e92c7b6647f2681b7a5b5f62ef7df41ce386aaf0c79f9ae25fc192372c9f6483cf4d836eed67d5d654f3e73e29", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220705, "uuid": "12f598e3-58f5-4661-9319-be2e772444f8", "value": "T1DA32CF06AF62227A697B6CBD707F5282BD4C5A4A47422C937F3B776A10FB0C01740E75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220705, "uuid": "53cb0669-d1db-4624-8a07-13fecab465fa", "value": "192:YgicLCABHWjC3bYmQPwSFDTWTJQ5dAnd3xeL25EFeaDbQ:nzLdwGLYlPrTcQ5+heLyErDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220705, "uuid": "050f6759-d97a-46db-a220-0a76bc2a4ad2", "value": 11408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220705, "uuid": "3c2d513d-3aaa-42dc-ada1-822e7059c359", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220705, "uuid": "7e95249b-6efd-4acd-908e-47d991b33895", "value": "images_20260728_055731.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce7227a-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785211037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211037, "uuid": "6f12a3b7-b33e-495b-8ef7-b988e3f748ee", "comment": "Malware payload (Mirai)", "value": "31e42e785e44957a5f997e6d51733d13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211037, "uuid": "ec7c5efe-4e08-469c-b5da-a8a8c683e232", "comment": "Malware payload (Mirai)", "value": "e39da22d5e118a663265da52827a2cf37517af6f55d6c78df7fa738b8f084326", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211037, "uuid": "ecf2e02c-88bd-47a8-a5c8-246f3d35078c", "comment": "Malware payload (Mirai)", "value": "f5f02f2a9b0fa6f32db009a0366169b73f8a933d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211037, "uuid": "a2535b61-6405-4680-9366-68079907ea9b", "comment": "Malware payload (Mirai)", "value": "60cc3c831df141dde4d638344689e4cd6b4b1a09f96ea614e2a4642615dc392ba88e31becf99d345a409aa8be382b635", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211037, "uuid": "f9238398-d536-4851-a48f-e1be263a7df6", "value": "T142D46C02EF841FEBC4AFCD30856E830715ED9D9702D5A635A1BC8D5CBA8D25B4BE3498", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211037, "uuid": "4722a33e-b3b2-4ed4-8b9b-5bfb6f926e8e", "value": "12288:cRDIsQKVKKOUJM5t48YoSLMurXdzl2AuzjuNtQU+1jOS7P1wKGGfmrlOhlgzubJG:orVKKOSM5OMftttKHg2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211037, "uuid": "0655d7af-cce1-40ec-8551-7c6c48f0037f", "value": 598204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211037, "uuid": "5ead133e-7907-4a86-a463-ae651b8dbde3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211037, "uuid": "3f7874aa-8fb0-4ebf-93af-d60b30244b56", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff3b7b3-8a51-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221806, "uuid": "e4b010e2-2be2-4ed7-8c73-1e1e0ecbc78b", "comment": "Malware payload", "value": "b515296b1084ea7c7099850e3217508f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221806, "uuid": "e69497ff-f11f-4a6a-b544-87480a92bc85", "comment": "Malware payload", "value": "e467e65713b5ee80c9ff468914d84ea161cc3a40509d7bf25b17dccec0868c88", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221806, "uuid": "26f09dc8-294e-4338-b1ce-bd64d75c5e5e", "comment": "Malware payload", "value": "231a2ab9a283d0bd5171e4ac1f6fd740207992d7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221806, "uuid": "6b46e0f4-810c-4849-a006-8ca279e6a204", "comment": "Malware payload", "value": "592cbe075582818724311c739c600166ed72196393301bfad1b6f164109850dd10fddfcbad220b840dfe41f1c07e5aa3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221806, "uuid": "d1b674f9-bf19-4774-ae7e-e82337567306", "value": "T1D4236C6526857C24AA98C4371D7E2F0CBDAD43E6320492EE7FCA3CF28C5A69DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221806, "uuid": "dac8d2c0-a37e-4057-a26f-019ec6469830", "value": "768:7XRWNGxV99GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Vlxccr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221806, "uuid": "79303e1a-721c-4fc3-b5df-7b20cbc6fedd", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221806, "uuid": "7c0be82c-c081-4107-a669-5663568e5c80", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221806, "uuid": "67d276cf-1313-4f92-9ff9-7a9ab5871614", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b712367a-8a8a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785246380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246380, "uuid": "7f362006-649c-413e-96a3-dbec18394c04", "comment": "Malware payload", "value": "7d25bee21215995458ca135ce67a7808", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246380, "uuid": "73c4acf7-cb80-4baa-a498-f9e1ce235541", "comment": "Malware payload", "value": "e59711c5e2e7d071d0810743998a21338951a33a96836a9861f08c58c6e07506", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246380, "uuid": "dc8445d6-caf2-4a71-9ae8-4588e70d10ad", "comment": "Malware payload", "value": "e749589c4450ee195d57af6d46c052bb880c323d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246380, "uuid": "71861a63-5860-422a-b9fc-a7f588fb1476", "comment": "Malware payload", "value": "db46b7d317f8b70dabea09b75fa380150be3823681114dbb446a56938761db193f00d51fda6af65a636d6862872b3da1", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246380, "uuid": "94f90d87-8ec0-49a0-a3f1-6faf1f8ad3bc", "value": "T1CB52463C4BF6FDC087CBE2B98049661340E4467B75B10B29F4EE85536B5C21D1E3A28B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246380, "uuid": "b9853ae6-b825-428d-ad8b-f9c37e8919ab", "value": "48:32h4uuQ/Sh4WxuQ/Zlduuuu8QhOduwcePoyUGRg1h4KeNh4t/xxyIuQ/52h4nmG:ZuuQ/FSuQ/7wjkekzuQ/Th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785246380, "uuid": "eaf2ca29-d67b-4e57-8ac7-23e4049014c4", "value": 14429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785246380, "uuid": "9adef0e5-b526-4619-95b6-0d5357282044", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246380, "uuid": "aebcb51b-62fb-4b37-8059-0cc96f961ab3", "value": "givenmethebestthignswithbetterplacescomingfromthebest.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85557ac7-8a56-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785223963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223963, "uuid": "0374fe41-ef6b-44de-986e-d7dc960c859b", "comment": "Malware payload", "value": "621a53cb60c7b0c51907d886db2d96a5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223963, "uuid": "2fa695f0-f1aa-4c5b-ab3b-9b65722a3617", "comment": "Malware payload", "value": "e5d2af04e4a091e6d7188300b26c89f6a0a83bc95f1d6694dbfab44111b88d3a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223963, "uuid": "9ba50819-cb4b-4394-a6d1-9172b0747366", "comment": "Malware payload", "value": "06543139e3edbcaa6d3f0cbb77de4d9ee76a32fa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223963, "uuid": "f11f7187-6094-4a38-83d1-0cac8965845d", "comment": "Malware payload", "value": "5f6a168abcdf1399ff352cf814500dbeaf70812131e8c319065d99178bc7e28910df569b30fab41064f50ee93a057d6e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785223963, "uuid": "b868fe66-70e7-434b-a7df-5097b6be320a", "value": "T1F3236D661A857C14AA98D4371D7E2F0CBDAD43E6320492DE7FCB3CF28C5AA9D910871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785223963, "uuid": "dafa2053-d538-4161-8255-857483e02db4", "value": "768:mXRWNGxV49GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Clx3cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785223963, "uuid": "e9cf8c97-94d7-4042-8c48-06e4184c3539", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785223963, "uuid": "621eee99-664f-42b0-864a-0df05e929884", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785223963, "uuid": "f89afe0d-a0e2-4753-8edf-d41c65922876", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b83f1da-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220833, "uuid": "922032e2-5ee3-4c7b-b20e-c498a25691dd", "comment": "Malware payload", "value": "29f4d8392a2cee53da933a37ad9e1e61", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220833, "uuid": "00933e87-456f-4b73-8de4-c0136979ac4f", "comment": "Malware payload", "value": "e7e7c79f3be654eb5f003b6ee60eb9cab6c46771ff157ce43e7b088cae37f67b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220833, "uuid": "15986289-670e-43a9-a386-77ccaa0dcba5", "comment": "Malware payload", "value": "4d045b8e4237f7a57c0ffbd32015049dc180a093", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220833, "uuid": "c59805e4-cc7f-4856-8a47-ec75cff21a56", "comment": "Malware payload", "value": "f7871cf8a5f3c80bb409489dfbe552d3d57165f80850f8e1ae7b55032fd09530b9033126c206dfd8d1893bd7475be5bc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220833, "uuid": "bef634c6-a2e8-4b91-9375-7f168ff21b6f", "value": "T14012BFAF81963CCAD5D83A76F2C82B3E234865488F1562346ACE7E104C3749B4797B4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220833, "uuid": "da937817-14b6-41f1-a36b-68bd4c2f5a2f", "value": "192:dl7i3hK3vTiLmaBUuKPjlqMMStouxHXwykHO:zSeLiLTtCjghIwygO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220833, "uuid": "576d765e-aaa3-4a34-a139-0aa00e5322a2", "value": 9210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220833, "uuid": "15ca3cb7-aa18-4d9d-bf1f-21adadcd355b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220833, "uuid": "8ff4f2e2-3559-4b5e-b092-24260ad94d3a", "value": "images_20260727_133402.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4663c19-8a96-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785251637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251637, "uuid": "541f3c21-6f8e-45dd-8f7b-ada5f6fa3c82", "comment": "Malware payload", "value": "4f0b8f82ff827545397b88791397eff5", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251637, "uuid": "ba0e0896-5b30-42b4-90fe-658c8b46ce0e", "comment": "Malware payload", "value": "e8180f168039d3887798d4865b09a033d8f879c284ab9befc69794e1581eadec", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251637, "uuid": "e3e00816-dd1e-4710-8e4e-168bdc403b1f", "comment": "Malware payload", "value": "3dd3f36eb668c09e41594a1bb327100aab45ffbf", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251637, "uuid": "8fbf9014-be76-4b1a-82fa-7715df3563ed", "comment": "Malware payload", "value": "331107542b56b6c18da6692171ebf76104c161d4d2e5958f35d475c2a68c915a5f741112494f8d6ebdff0f1237ae531c", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251637, "uuid": "82064ae1-2962-4551-8c6e-c6778c9ce901", "value": "T1664110F1B89A1DA058F61834A1DAAC0ED1559CF865187D367C2038C85BF30EE2BDE079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251637, "uuid": "9cfeb92a-3160-4372-aa12-162d8c88f33b", "value": "48:eitldjUsNrI9TI6fvl9mDYPSfO0E4Md/LODco:eqlhUs29TRvl9MYPSnMddo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785251637, "uuid": "60ba7e18-7ade-4fd7-bcac-f9cb8159f0ae", "value": 2009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785251637, "uuid": "80b2430c-0d81-40e7-815a-2c261aa251f4", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251637, "uuid": "44a6bc69-cf22-4179-9e12-ea6771109567", "value": "b_6a4231612d611.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc23cd81-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221075, "uuid": "7f7928b7-c9e3-46cb-914a-f3ccfb685b21", "comment": "Malware payload", "value": "664392532b6f85f675d8524801d3dffd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221075, "uuid": "420c2aa4-e246-40eb-be50-cb5ab44e223b", "comment": "Malware payload", "value": "e877368669bf055b683fe1ae70b530ebe2921d185dd817d1b61cfedefcf58d5f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221075, "uuid": "c4415700-dfb4-468d-8259-59cbd89ba0d4", "comment": "Malware payload", "value": "811ec7927790eb3031c3a8cbda7aebf4a8a60579", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221075, "uuid": "4c1b3bef-6b7a-48a2-93c6-e1f80cf5fae9", "comment": "Malware payload", "value": "69126ab2b2bb218c3b72d90b80a7e8ab22c862024af1fa3e45fdc2dcc58b0279c075533af76378d73c90f7a8e49eb0e0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221075, "uuid": "06f2b363-fb6a-4ab3-84c5-543189ce86f6", "value": "T1C7A16D3ACA041683F353247FAED4F48DD9BCC1F801C75910B26876B90A4A9F65F35BA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221075, "uuid": "ab837fed-99f3-4234-9d83-144e2803b110", "value": "96:gX+EQQ3wP0PbQlRayWaZ2iYEpGTE2WJl5AdzqrL5Y2:gX9/3pbyWagpY/oELF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221075, "uuid": "53883b35-bef8-451e-a3ec-0424abec1192", "value": 4632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221075, "uuid": "6c582e98-7f1e-4910-8ad5-578996de4719", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221075, "uuid": "202a4e43-71b3-4087-854a-12c88c7558bc", "value": "images_20260727_180759.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9f2db8-8a24-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785202452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785202452, "uuid": "f13df332-0fd9-4693-8c3c-71e17b19d4b1", "comment": "Malware payload", "value": "0b3ae315d453e6fe2f740534e8875037", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785202452, "uuid": "9bf225b8-a023-4678-bb3c-48fe37cac707", "comment": "Malware payload", "value": "e8d94cfce33842bb9e66771d9c32a8c460fbf4ab60a39c55e0ade8b3352abd9d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785202452, "uuid": "329d185a-7f6d-44a8-8c30-c0cc40c35380", "comment": "Malware payload", "value": "7b880e7fbe659d5e8b557144ca706d4cd8ad0708", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785202452, "uuid": "941020e2-318f-434c-bb13-4cb9ab09e32a", "comment": "Malware payload", "value": "f5a92aa680525036b3a47dc43d661e40bb5745b10b4bd6e20d261d6483fd0f1134a712359344cbedeb9688c104d031c1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785202452, "uuid": "9123771c-1a95-4806-9290-9754a8a829a9", "value": "T16AC28D966A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785202452, "uuid": "85b91eaa-42c4-4bd6-80ee-077a166ba395", "value": "768:m8vCB+25j6es8RF9FYpMSUpi+20qUpi+20YQX:m8l25Jjd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785202452, "uuid": "3d561725-3c9c-436d-8e18-a0459393e9d2", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785202452, "uuid": "0c838826-6e9a-4154-9378-6f8c9f78e112", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785202452, "uuid": "96e1c7d2-72a2-4390-b87a-3885a47dc7aa", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430afc3d-8a96-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785251339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251339, "uuid": "da044dd5-4b2d-4ef7-858e-bc5283eb36de", "comment": "Malware payload (Mirai)", "value": "0017820d57627a8709e4a4a46c33dce9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251339, "uuid": "abefc1f2-5633-4aea-8997-476ec95d8f37", "comment": "Malware payload (Mirai)", "value": "e8dd6cdf0e6080389d02db9e85ccbf5512a6e04670428654c01e8e321e24acfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251339, "uuid": "d27fa3a9-45c9-43d4-b9b6-366b93ef6173", "comment": "Malware payload (Mirai)", "value": "dc6a4cf0d643cd5a470eb1f02596ef1970d5df93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251339, "uuid": "ec66449a-7f2d-495e-b50c-1fbdfebbb207", "comment": "Malware payload (Mirai)", "value": "377d9269c98d8fcf697094f16d8303e56f32d97ca5f034a7297bdd985c538e6368b796c4c7919d4cfefffccaccdfe54a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251339, "uuid": "cbea692e-217b-448c-9dde-c4fafe702ea0", "value": "T136F36B07B4D094FEC8D9C1749BAFA236EA32F0495134B21F23C46E263E5EF216B6D654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251339, "uuid": "440eeb60-d135-472b-b3a6-d65386e8e5c5", "value": "3072:HNB8fAsCufFbybSvMTJ119NRXW4+eI+bmG8VCoClk:78fJqbhP7P+Nmlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785251339, "uuid": "f2c14c03-0537-45bf-94b4-57b95aa92fed", "value": 164272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785251339, "uuid": "0d7428e5-04f4-4bb4-9b71-4402c494b254", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251339, "uuid": "07a5cd36-02bb-480c-92d8-b92749b2caa4", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71159a7-8a20-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785200827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200827, "uuid": "c268459b-4a96-4b66-94aa-eca9105568f8", "comment": "Malware payload (Phorpiex)", "value": "4a93a809cf87667cb73e0405f5e5b102", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200827, "uuid": "4b40b0af-be63-46bb-ae4b-c1c41cd78a8f", "comment": "Malware payload (Phorpiex)", "value": "e947f8a540eb337c4090c14d880948f07106dbe19d64625b7577cf9416935fae", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200827, "uuid": "8b5aafde-4c4c-4e9d-b0db-cb1cf137c8fd", "comment": "Malware payload (Phorpiex)", "value": "819f0be1dbc81eb85163de4cea0f629c10325ec3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200827, "uuid": "7ec63d9f-ba94-4022-b940-5988b5698166", "comment": "Malware payload (Phorpiex)", "value": "fd2e15292f7c9872caff00c23f09fd3dd4dfd03dff232b0bbf9154a87c273d5092df849c0504ed5744b264219fc5775c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200827, "uuid": "3f19301c-0535-47d7-a0ab-8308985ef638", "value": "T13C622A0AA4818035EAE14075827F526645FE6DB623C4F9D7F7E0A8C94DB4BD1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200827, "uuid": "694449ff-c4de-478c-a93a-d1a37371a335", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200827, "uuid": "050369ac-a141-4a3f-9e01-ccc0f262c572", "value": "192:AWtsGnjXgjk8LcRI+Q1RDMlYfV/F5oIVUBKUSftzQFBrfgJxTmv8U9cthA9ik:AwScCtfV/ro6toB0av8U9cGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785200827, "uuid": "648571cf-d343-4b8e-9973-43eb80bd3c80", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785200827, "uuid": "f3f26c55-538f-4ae7-b152-4479890c98d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200827, "uuid": "3f8bd363-d7f7-4c26-8b5b-0eda17102589", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01df7860-8ac8-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1785272705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272705, "uuid": "44f60431-9bc3-44a4-8ada-db05c4fcfb3c", "comment": "Malware payload (njrat)", "value": "cee0e495adc06bbac4be33544bd393ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272705, "uuid": "8b231c0a-c8ad-476b-9df8-a09e83ecb0f1", "comment": "Malware payload (njrat)", "value": "e95766d2d9dcc598cada3c33133935fda7d54d245d8a46fc05be47986e036fff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272705, "uuid": "51ce0834-5ec1-4844-889f-7bc3b98eb44d", "comment": "Malware payload (njrat)", "value": "b65b3aba7086a8db3b452f171782af7eab4cbeb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272705, "uuid": "3142d2ad-a760-443a-b9d6-9ba1e77f6866", "comment": "Malware payload (njrat)", "value": "54514132ca547db7b21d1259e927b24faff347d495348f1ac2b391b101b3c226bc13ad1296cf5a650059bc2854845bbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785272705, "uuid": "fed5fa74-bdae-46a5-9e6d-bccdc364e745", "value": "T176447317AB79AC0BC25CC6309CB6E278A5EC2E67DC1CC708ABC19D5F762718E8D0465D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785272705, "uuid": "b275e26c-b996-4848-9f95-f42f500afb2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785272705, "uuid": "ef9db11f-d382-4d8c-b3ee-39d74e788b9c", "value": "3072:xMDnk5ELWDhwsNMDzXExI3pmUHLB2VsgyxTOao8oY0h6:xMwwWvMDrtgSTXLV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785272705, "uuid": "c61f2543-6f2c-44b2-b6f3-7fc6d95d43d1", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785272705, "uuid": "7c3794b7-657d-406c-9536-122535cb713c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785272705, "uuid": "29ee4625-97bd-4385-b860-1b40936e1868", "value": "CEE0E495ADC06BBAC4BE33544BD393CA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ebc841-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785224449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224449, "uuid": "477a0eb5-15f6-4728-84b9-c30e999188a3", "comment": "Malware payload", "value": "e6477604e55dbefd9e9df87218c701c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224449, "uuid": "469325bb-51a6-4a0a-973e-97412808d734", "comment": "Malware payload", "value": "e9b9f3f9422ee0938e6c7dea3ff055b049bc403dcdec89e34b7cb73c2fb8ab7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224449, "uuid": "38519f01-a581-4887-a6e8-e6eafff817fc", "comment": "Malware payload", "value": "d772047906cbca0ab069a53569f258ed3035bfc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224449, "uuid": "c4327c82-8d12-4914-8103-9fd247017981", "comment": "Malware payload", "value": "28b73c25596a6c6274e808df5927919baf9981bd00f05f5763a18390a71f5604b14fef12a2d320700de0a4e8337413a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224449, "uuid": "617c1009-8fe5-4c15-bb50-ad1ce960ec0d", "value": "T12836FA14ACC43BEBC05C5A7864EEC95622B45D044AF24A2A25A4FBEDBC762747F47CCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224449, "uuid": "ee5e2610-19ec-418a-bd3c-af048b12d18e", "value": "49152:8p3d67716p9mUb0thAjabDVcavxvK073E5EH:YIthLvK0732EH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224449, "uuid": "ff629555-2d31-459c-b4f3-216db801e2ff", "value": 5308595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224449, "uuid": "b7ca986c-d259-4da5-b678-6fd1cc45655d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224449, "uuid": "0ed85d25-8daf-49d5-9ea0-f671c8b7fd2a", "value": "ecryptfsd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7856c3de-8a56-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785223941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223941, "uuid": "b248ece7-4dba-447e-84ae-cda50615c527", "comment": "Malware payload", "value": "6250abb7ece7480a98fb177b30f14e2f", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223941, "uuid": "d6b08715-09e6-4839-9c81-9e31a240231e", "comment": "Malware payload", "value": "e9ebfb558822e82e6f78f49bcd73b5a77949be70ce34f2db593133204c96d617", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223941, "uuid": "6b199efb-8b38-43fa-acd0-91e5065eae4b", "comment": "Malware payload", "value": "65670d19b79f9e3b4d17471ab7914a59970c4ca4", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223941, "uuid": "18d77aca-0b7d-4458-ba82-8cc9626ae9f4", "comment": "Malware payload", "value": "7f19665a8e2d51e7c0c41d4290537e81c28ccb4091b7f3d38719c741fb56f8da6288643a247727e251056ce84cc51633", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785223941, "uuid": "0f624f39-4ede-4e89-b10b-8bae57abba0f", "value": "T1164523176685EF76C2735636C4CAE15E5E0CBE1F68079AEB2350B309AA763E047C305E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785223941, "uuid": "8e995e1b-4cf5-4a5b-9ac9-f3dc55c92c28", "value": "12288:4PmdKygHbVcftB2uOi9ckaaiZgmXeZ6y2s5LQSi8oQJdti0/7Ka28HAjYFEpN9Z/:C8tApcJ192vXefjD30ZjLHtNzJm+44t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785223941, "uuid": "c475021c-14dc-4deb-9530-34af9f68b2c2", "value": 1186816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785223941, "uuid": "11db4476-d256-44ed-9d10-b649ef741dc8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785223941, "uuid": "7b765c8d-e0e6-4c5e-ab07-21a0bea8d4e3", "value": "Tellimus nr 5216E04FAE .xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0756fedc-8a50-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221175, "uuid": "e1a52cd0-b1b7-4650-8210-840d6c09845f", "comment": "Malware payload", "value": "980b23b0bdd3572578e62ce3ffcba778", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221175, "uuid": "32d7dc96-ad1f-471d-9ed7-0909b99a651a", "comment": "Malware payload", "value": "ea056acf5d92eb07bb032f88e679c73aeca7d0e43b8244667ef02c9170dba945", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221175, "uuid": "baab3c0a-f11e-4c52-978e-13472ecc1da3", "comment": "Malware payload", "value": "3ba179477377ea157bda64f374430564bbc83b24", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221175, "uuid": "f4f33361-f2f3-4fec-8b1c-336b0d40bd0f", "comment": "Malware payload", "value": "b960205f9643961757a1b697ad2e74279c0ead0545a2ae3cdd94da5bb9b6a19c1d684311fba67e68f843759a5ac238b7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221175, "uuid": "2bf069ba-24f6-4bf0-a1f0-828d73bb11af", "value": "T142F19EF3CFD606A1DEBC1F79E727BF19AAAB0A4A11105D59DFC0A9CA9CE10550B2DC01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221175, "uuid": "34df6e05-7354-4b93-b650-3a96144d7b3c", "value": "192:gC4LEixrZnuv1lWUZNSL1lVQe9TTrXu6VpLWtSSPo4GUSfYe:g5zZ2BZCHHXu6bODQ4HSQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221175, "uuid": "f36d87c8-645b-4533-bae9-9df2e388f059", "value": 7764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221175, "uuid": "fdc07df8-d30c-4e42-a12c-230f02dfc0fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221175, "uuid": "0888ad15-c617-4bff-b98a-88b1e7337578", "value": "images_20260727_175216.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f59f52-8a7b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785239996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239996, "uuid": "df53eb86-8757-4b07-88ec-2340d1178969", "comment": "Malware payload", "value": "9b185381680f3c6c073718da1d6b5a6c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware-analysis", "colour": "#279256", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239996, "uuid": "335854c0-a332-4412-9456-b71c7464cff1", "comment": "Malware payload", "value": "ea61dd44be70142c8c307c36e8438b37e6147f55fdc27599b0b6e0592bfc7bde", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware-analysis", "colour": "#279256", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239996, "uuid": "603732f6-a15e-4de9-b6a8-43e8d74a647c", "comment": "Malware payload", "value": "4db38656a3578a728d35dd964448909adf40c8b6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware-analysis", "colour": "#279256", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239996, "uuid": "c14eb3a5-181b-4731-bc0d-927f65077424", "comment": "Malware payload", "value": "d6cf6c9ed1a5c704503598692e670546a26901f2f7e14dbdf276488138a91be846e110b08e030c3784e53549ffc588d1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware-analysis", "colour": "#279256", "exportable": true, "hide_tag": false }, { "name": "SHAPARAK", "colour": "#125FCB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239996, "uuid": "8d317c75-9a26-4152-9096-baca71ed06ad", "value": "T12606E095BF44593FC47780334B665239326A8D16CF82A74BB858336C6877ADC4F89BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239996, "uuid": "b2dced6b-d763-47a7-9ebe-cbed8310f66c", "value": "98304:4z39MIuIZcEL+gntJyEsUK2Qz/OBd4bOlDbJeDayYP3W37yfY4f:4z3aIustJyEsv/OL4bOlDbJeDaywgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785239996, "uuid": "a9f7ea35-0e99-4712-b2dc-4f180717d7c4", "value": 3931506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785239996, "uuid": "3f5dd731-2782-44cb-9c4b-71a08de81a6d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239996, "uuid": "5755c1a8-929f-4dca-82e7-52a03d03066d", "value": "mellat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650c3e24-8a6d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233787, "uuid": "316e1498-d6d6-4bd4-aab6-4d5c4c52a92a", "comment": "Malware payload", "value": "ebff034a4e85a282b76669124606180c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233787, "uuid": "ec34ce88-4a8e-45f9-a26e-cef7ba02b1a7", "comment": "Malware payload", "value": "eaab14022dd3adbedfcd16c55564346a2ebdaf6c335ea2713ff88ea8892bdd33", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233787, "uuid": "d8d71c64-0d1b-4e58-8ab5-c91cc0cbce28", "comment": "Malware payload", "value": "abe004422718c38fd96981a9358a9e9824c8109c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233787, "uuid": "ae77b589-4fca-433b-b0c3-f2aa9f376e34", "comment": "Malware payload", "value": "94330eb1ab6e32185039f9804976eea3d2e17b2a78d687883bc789a41e09bda2659cf469082eb6edb839b746829d9c11", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233787, "uuid": "3683b780-2348-4fdf-a8b4-75ce3152eeeb", "value": "T1E7C27D96AA867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233787, "uuid": "6cc09c24-849b-4dd9-ac96-2b2c3dc8a868", "value": "768:18vCB+25j6es8RNm99FYpMSUpi+20qUpi+20YQX:18l25JNCd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233787, "uuid": "fe7f4d8e-cba3-47e9-8e20-ebb0bf0a49e5", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233787, "uuid": "8a9399de-3118-4c47-8a8a-6fe8df37b285", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233787, "uuid": "b5b09b64-ee4a-49c5-b34d-fc12e9ec3c24", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40a1300-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221062, "uuid": "d3948577-f832-4b86-9c46-979068724690", "comment": "Malware payload", "value": "c984532069cc3720b055903f85a64ce6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221062, "uuid": "65c9a78e-a79a-4627-b2f9-63f93fcd142f", "comment": "Malware payload", "value": "eaed6bf37bf8112bf9f1466ba4f57028d19514d3bfd118ae7eab69525345d99a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221062, "uuid": "340e0957-0825-4de0-8fd4-d97ba006c370", "comment": "Malware payload", "value": "080c973f2ec430297f8559ded47a12c17d54119c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221062, "uuid": "8d76487b-417b-4042-aad7-bdf13cf976c7", "comment": "Malware payload", "value": "aa31af5ec7e1c1eb1ddb75b98c707da1b297c35b9b5ddd03e76f0adafd510221c7b9e3128673cf616333e0fefb3e23d7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221062, "uuid": "3530d407-0b0c-4af5-9daf-246fd5a315ee", "value": "T144D18E44832D0C33D18AAAF5F50B8BCF745CD6E418156B656A8B00CC9EFE657C66C43C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221062, "uuid": "a7cbef28-450c-457c-9b33-91b5762bd87b", "value": "192:OPQiiATQUNCZH+OSuzOAqsGLfOMuMdSCRryo:gh5GH3Su6ACKfMdfRWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221062, "uuid": "566abc5d-55d9-4a3b-be2e-4677261c0fbb", "value": 6236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221062, "uuid": "fdc7ab89-1bf8-423c-8df6-fdd6438be3bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221062, "uuid": "954444d8-c9ed-4cad-826f-31479e150017", "value": "images_20260728_050926.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87df6427-8a1c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785199056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785199056, "uuid": "e29cc7c3-a24e-4388-96fc-ee2485d15e85", "comment": "Malware payload (Mirai)", "value": "123134725663d85f9e2de04980131fca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785199056, "uuid": "9e0acba0-19a1-4802-a0ae-a8528b072f02", "comment": "Malware payload (Mirai)", "value": "eb71de1615f852d0d2816198901c157bfdab1f62dd3b2d029a4b167a7ba2b3fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785199056, "uuid": "a19230f2-b902-413a-a1b2-e14484baf23b", "comment": "Malware payload (Mirai)", "value": "5d7185e16f90433e860091445cfa904ad6a5ba6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785199056, "uuid": "a9790f13-ffce-4cfe-abec-bd930d6e1066", "comment": "Malware payload (Mirai)", "value": "f4a2098871a9d1bafaa90dbb493c5d093fc76f54ec784e15dbd8476a54ff90559bf72b447d395a69459b45a2ef2f1940", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785199056, "uuid": "db028e4d-a796-43d1-8c00-3b290e4c1e72", "value": "T163731A59F9919A22C5C155BFFE0F828D772243E8D2EB3307DE296F61368786B0D2B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785199056, "uuid": "3f7e4ea5-1b71-4ed6-b081-c28cfa72a1a9", "value": "1536:Q7BQDUIr3rLAom/Z6y07fTLidPYPLmOTODsOn9ebvyfn5ZLCORs:JTrL1s6XbedPEmQQn5bs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785199056, "uuid": "38d2215b-59af-4711-84b5-467d2c2bd745", "value": 74880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785199056, "uuid": "9c6e7759-84de-47f2-9ca5-f7a5b97bf662", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785199056, "uuid": "f2b5251e-328b-4ccb-9a4e-26fcbd144364", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee7a00f-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220972, "uuid": "3f466f62-eb6c-4259-9fcb-bdf8be50720c", "comment": "Malware payload", "value": "312bea50be05fba706ead688b65aa182", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220972, "uuid": "eb15aa8d-70d5-459e-889b-4c2461906a7b", "comment": "Malware payload", "value": "eb74a624eeb75f77ce92d4b0eedc5dbbfe9746e3ab596daa8b801e7e3e19c9da", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220972, "uuid": "d494a8db-38c8-4fc8-b470-a3cf9c04fc13", "comment": "Malware payload", "value": "12cac2dca43aa3037abd3aaacc13763d732a8e55", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220972, "uuid": "c8584961-182d-4338-b332-2862a984ff71", "comment": "Malware payload", "value": "7f9d7a351782415b6955eb6f4fa6aaf88bf9306ebe87b74d80286b9d4ed214c6113dca66ec290fe82e2235d3cc77d295", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220972, "uuid": "90fa35b5-e2c5-4147-a061-1df5233b08d2", "value": "T1E8816C596A65CCC0C3A792F8E6EAB9DA603685E897C17724E92B611CC490CCC527E1A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220972, "uuid": "14738ff2-6a35-48bd-a962-74dfdabb5972", "value": "96:u+E8Ipa2YLYW9CQAP11wOJiLMFJiDVoQaBlDp4AMg:pHItYLZ9CQq1vJiLMGmV1XMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220972, "uuid": "edbe7305-7b90-47a5-ac92-83372d41d330", "value": 3929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220972, "uuid": "42fc62bd-f99a-4233-a44b-5c3b9c50c251", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220972, "uuid": "a85ede91-ed7a-4327-8494-cf478c3c5eca", "value": "images_20260727_131325.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7df26e9-8a86-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785244690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785244690, "uuid": "31a916fd-5cbb-479c-b9ce-4fa64f3cb35f", "comment": "Malware payload (PureLogsStealer)", "value": "f7a37ed320f2ee343ef71992d1257d72", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785244690, "uuid": "8e33c749-f464-481b-91cb-55c07d5afa25", "comment": "Malware payload (PureLogsStealer)", "value": "ec292b53c9f56152d0e4f7e0b62eaf0b5fe495efda49c2cfa38c7643da9c7e2d", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785244690, "uuid": "a24de7b3-e609-457c-897d-34b3f95b4236", "comment": "Malware payload (PureLogsStealer)", "value": "2ac76ff7f668373f2e3d20156808461758dcce6c", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785244690, "uuid": "95a7ccfe-81f4-4a51-95ab-9d093c8ea05e", "comment": "Malware payload (PureLogsStealer)", "value": "aa49b2f88743040ebceaeda6d5c53db0c7fef2d7bd3ef0297433a40704e4c46f40164e32c48033541e2860a05075709c", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785244690, "uuid": "ce267cd6-2834-4e5e-b5cc-d70ec307dc65", "value": "T108452303E605FA3FD132563A858BC8865A1DBE2FB501AF670E91F34275377E1A7A600D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785244690, "uuid": "2ff09bc6-212c-47aa-936c-ff8bcdb27f8e", "value": "24576:uWp/4edodG1sxxcR8tApcJ19Okio1MdoU+CIB/+TiCCABXyi5hT:uWplwc8tCk+RJ2ohJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785244690, "uuid": "e5c458e3-a446-4640-a1f1-d42a692e95b5", "value": 1184256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785244690, "uuid": "47e1d1df-5bed-4280-a892-2f6ff8f0d848", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785244690, "uuid": "19578920-b31f-40ea-b089-89b29c9dba08", "value": "asaraneller.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8481c91-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221122, "uuid": "2124e4f8-4317-42c0-96a8-3edfe3a9554e", "comment": "Malware payload", "value": "b00658300f68e08905e25c01139f75cf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221122, "uuid": "bca0371c-7896-4e7b-b09c-e69ec9e1649f", "comment": "Malware payload", "value": "ed3b8d3590035ab9bc664a860bf4fc30638260d96b28974857e14c2db359f555", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221122, "uuid": "f9edfaf9-6ed6-4c98-befe-d8fdded40523", "comment": "Malware payload", "value": "36bba39aa131ee3002e93a1224ac50bea0d524b2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221122, "uuid": "41d6ac5f-af8b-4d54-9576-7792357f6eb7", "comment": "Malware payload", "value": "95a5d7d9096e624fed312aa8119ab3c9f244996752450c29d2e494e18780048a1f326f96522d855fd1bc917d6bb20045", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221122, "uuid": "e3270e1e-17b3-4b27-9cdd-6a9277f31ece", "value": "T19172D14F98257A491BD14639659A753A53CEFCC95342E3CA2D6958ECB836083F0727B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221122, "uuid": "1629f022-acde-4667-b209-6b195c8fa6b7", "value": "384:77o1T9JBIxFoGx56eKuEMWFJR3eimxJy+DHds/fn4qVksqhUqmuM1Tbk:v+BIxSGj5kMWPROimxPH84qVTqhW90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221122, "uuid": "5c7c9316-7bc2-4a03-ac0d-9d34367c171d", "value": 16984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221122, "uuid": "7ec4228c-84f0-4a5b-ba8f-90cb97d02e48", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221122, "uuid": "f9d84665-cc44-43cc-a983-bfe171efc65d", "value": "images_20260728_021422.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed51462-8a91-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1785249373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249373, "uuid": "9b75c460-1d75-499f-ad09-254fc92bb4b0", "comment": "Malware payload (VIPKeylogger)", "value": "da8e26b87e7ab3bbc11d9871cc400627", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249373, "uuid": "0286ad0b-88c9-4082-bbc0-0d511c2030e4", "comment": "Malware payload (VIPKeylogger)", "value": "ed48e74129c7f946abf72f6a14d4683a69cad54787e91c8a0b84b41b5eedfbd5", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249373, "uuid": "091b3859-97ba-4c45-9c91-4c2d5c39a901", "comment": "Malware payload (VIPKeylogger)", "value": "eb39e030b6c13c2c8a28e88b75f489b6dc624604", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785249373, "uuid": "bae16e1c-ed52-4615-bd3f-3cfcabb685de", "comment": "Malware payload (VIPKeylogger)", "value": "4c743ca11a3ed135d66f3d481d12b1f9e502aacb9e8750f6a8fe66521e4ecefad234a9f29308045f961f70e9bb55ca8f", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249373, "uuid": "5821461d-2754-4ef1-b647-a83192439d48", "value": "T1C7469F506E5859F5EF8C290E90AEAF1D87F042176A33706BFB41DF05BEDA241864B21F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249373, "uuid": "953f944d-c89c-4b53-a03a-16382cfdd675", "value": "24576:FqTdye/nXJYlqjDd+7A5zlQYRxHTkQ/QxrJk+jaDNlJBAR/cq65ZaL47HReAZxVc:k+D93X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785249373, "uuid": "5a7fbb9f-c52d-4555-a49a-5c64dd492696", "value": 5507119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785249373, "uuid": "f2aa2579-60d6-4773-9d8c-4d96535ea4e6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785249373, "uuid": "33867277-b1ab-4acf-a71c-88cb0258a629", "value": "Revised_Price_Offer.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6af41b-8ab9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785266552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785266552, "uuid": "0fab56ba-305d-43a6-80e8-0d9542b86c34", "comment": "Malware payload (Mirai)", "value": "599c16f5fbabf462caab4456efd51609", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785266552, "uuid": "8d50dab1-f6a6-4fe7-9157-78bf1b8a64d0", "comment": "Malware payload (Mirai)", "value": "ed714a097ff6169e1a9935c9b8b7e09afffc45aab659cac9c3bed8a146f83851", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785266552, "uuid": "9e87fa65-6e04-4b2b-b2ab-10d1e547b648", "comment": "Malware payload (Mirai)", "value": "7c6dbeff47c93357ff9803f22d570cc162d6af69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785266552, "uuid": "ba776dda-b071-4836-98c6-4848844f2aca", "comment": "Malware payload (Mirai)", "value": "335c1cff1919f7f0f58e0eedc0db85582b12f3a1b813d40e25ad4097152f0b6b173eef2766fefd6a7c8d90c9645d0dbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785266552, "uuid": "4eadd54d-0ec9-4db5-b0d8-116c6d57d483", "value": "T130831959FD80AF15E5D625BAFF0E514933634B6CE3EE72029E245B2523CA91B0F3B406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785266552, "uuid": "3d1af352-a3be-40f3-8f29-63f0036fa010", "value": "1536:UdnPNbbcPF14nuoFska9A5+mpiMwq5o82lkuIiY7ooBk12oZWYAcRN:M3cPWuoFska9AcmoMwqmG7ooBk12owUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785266552, "uuid": "09d3c02f-e8df-4630-b226-f898035f6bd2", "value": 83240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785266552, "uuid": "65385438-eb4c-4746-8b67-20ab8ab8537d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785266552, "uuid": "59e65596-5ed0-4954-a110-4a86473ff960", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0f79d6-8aac-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785260750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785260750, "uuid": "d7fb60ab-0572-4d64-947a-a5a817354708", "comment": "Malware payload", "value": "7cd8899c46813c65745386283430aee5", "object_relation": "md5", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "kill-rivals", "colour": "#80CF92", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "rediserver", "colour": "#D3FCA3", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "WatchDog", "colour": "#D28F16", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785260750, "uuid": "77dbd2ed-eb08-4a35-93b4-2bf84f127f26", "comment": "Malware payload", "value": "edd07c3b2b5af3f6f759496223b6b119330d582c4242c5c7fa69d620cc70d1ef", "object_relation": "sha256", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "kill-rivals", "colour": "#80CF92", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "rediserver", "colour": "#D3FCA3", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "WatchDog", "colour": "#D28F16", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785260750, "uuid": "3f90facf-b9ff-476a-b586-32ebe5db0e30", "comment": "Malware payload", "value": "39651c1365ec32df9ac33efa528ddd0c0129db1d", "object_relation": "sha1", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "kill-rivals", "colour": "#80CF92", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "rediserver", "colour": "#D3FCA3", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "WatchDog", "colour": "#D28F16", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785260750, "uuid": "793b54cc-5e84-46ff-96d2-2bf91d4b7897", "comment": "Malware payload", "value": "466594acda1537f584f1ed9941024c5c6aa710fa78d6843251c221b25bc0c00cc9435aadb7d9a6cecbc1bdc25448cd0b", "object_relation": "sha3-384", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "cryptojacking", "colour": "#09D7AE", "exportable": true, "hide_tag": false }, { "name": "kill-rivals", "colour": "#80CF92", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "rediserver", "colour": "#D3FCA3", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false }, { "name": "WatchDog", "colour": "#D28F16", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785260750, "uuid": "d4fecfea-2e57-4fb5-b91a-e582fc561d4b", "value": "T198F05909D818DC2A3DA80C6D44C62000B547864FDA651D38725EF9D11F09102B2BAA60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785260750, "uuid": "0931d5ef-2e6e-4e27-baf3-5ecc390e72e7", "value": "12:O+GXOpuesInbNfETTOJQgKzKvG45Tp9XRsyV3T3//Z3SyK:+isIVEmCgKK15V1RTb//kyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785260750, "uuid": "3416fbe6-ff0f-4fec-a40c-2577e1b7891c", "value": 494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785260750, "uuid": "33ff6604-f956-4608-a5f9-a88fc34be508", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785260750, "uuid": "f6aa6f9c-4633-469c-8892-aca05ca66a5d", "value": "p225_dl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e06fceb-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233265, "uuid": "68148a49-da08-438c-b662-bb716b3d228e", "comment": "Malware payload", "value": "6c2fa25a9611aa7c52611cfc81da994b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233265, "uuid": "44a45162-6b8f-45ba-95e2-9cd5a29683c7", "comment": "Malware payload", "value": "edf830c43d50f68b29bc99eed744e7bbd5f2530a2bd4d13731cb6595b5c1c25b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233265, "uuid": "03cf8a9f-597c-471a-9af1-a6171dcbc9ff", "comment": "Malware payload", "value": "f4de0344e539fc89bb980b1cafbf595a1ad07023", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233265, "uuid": "d7b3a5c5-6bde-4587-8cb0-7e09eea4ac0c", "comment": "Malware payload", "value": "02e86573c3041d8528bfcacc2f591880e09ad71f974e82997c7481aa06a60b3863e8f6fab4c2514e446a674800872696", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233265, "uuid": "3c1c9d34-0e65-4c50-8ab0-1a444d186d0b", "value": "T12B72D1E70D8843FCD5385FEAF7F288ED6693958525853A9F03A2EABC19E4150634E311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233265, "uuid": "587d658a-499c-40a2-9547-b175f37d0b6e", "value": "384:seqLNhqEBFEQJbn6a9xZgRqtFnF8DQjXqiggxFPVUHTIFX8S/rhJlTfY:sel+RJbnP9gRqtFAg6exRVUzIHFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233265, "uuid": "62bb032d-000d-4dff-b0b4-8f5c46c862cc", "value": 17243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233265, "uuid": "4b306f0f-efeb-4e62-9317-f31e551ed4c7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233265, "uuid": "70cfad73-275c-444c-bbac-6961b8d18a5f", "value": "images_20260728_053956.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ad2f31-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220883, "uuid": "4688a048-d97e-4d4e-8375-4c16f3ba9f20", "comment": "Malware payload", "value": "9ddaef2d7631417ddc220f569e1bb707", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220883, "uuid": "57bc50e8-c49b-4f6e-9b65-19b1fee7ef77", "comment": "Malware payload", "value": "eea01d1cba38e956092bae347d6ab65de12e4a8bd59284acd722aecd64a06ea8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220883, "uuid": "8f373b7c-99ca-4382-9552-1bf2183c2f5e", "comment": "Malware payload", "value": "2e7467e062f891ee19a995822351e10919f689cb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220883, "uuid": "a22ccc2d-9319-484c-ba50-7934bf5e0f66", "comment": "Malware payload", "value": "293135bfd578dc9a65407793f1eb1f9663a6dc2235538bba3b96e9fb8d9348f3393701f5e7fd2e4f72859f1127d7c5fd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220883, "uuid": "aabbe99e-0ea3-48ea-bf6f-ff060b12cfd1", "value": "T1CB52D1055D12B343DCC2FAFFB1C229284D5ABB6C5C0C3D7522F4509C5DAB09E59AB84D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220883, "uuid": "026aec8e-50b2-489b-9fbf-9b0b8eba0810", "value": "384:0rHo3QQr+1o2TVRgBj7PREtgaVb/c8vHg7kiI3:0Doo1tzaRQgadNYpI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220883, "uuid": "4362b923-605f-4494-9bb5-b2e0b26b3f3d", "value": 14046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220883, "uuid": "a5f09549-88bf-4e04-8345-c131fae5038e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220883, "uuid": "f2521734-68c4-4e1b-907c-079f557b2210", "value": "images_20260727_172611.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04d1ac0-8a48-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785218129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218129, "uuid": "e5d9e122-33dc-4cc8-8cf5-2e8464edf369", "comment": "Malware payload (AgentTesla)", "value": "80f7a04d96531b5eb38f8089dc584d9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218129, "uuid": "0443213e-9e60-45fb-a980-78f0ab4805ce", "comment": "Malware payload (AgentTesla)", "value": "ef436a36b3b42525f06b3839d5e3f50f6ff217549c8f25d88dfe6f24385ed161", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218129, "uuid": "4d45dd28-e056-4fd0-b675-a349c520cb08", "comment": "Malware payload (AgentTesla)", "value": "41c0fef6ce77b79a11ae14cecd30e6e8e5430608", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785218129, "uuid": "39fc2c78-ab71-4e8c-bafd-15df8f9040a4", "comment": "Malware payload (AgentTesla)", "value": "2678dd3b4c7dbbd5d4fc920886bdeef7c120850229b1aaacfed9e52e093bfe82263d7afca54c34757c418575ed0ea1cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785218129, "uuid": "cf85338e-5dc5-4098-ac6a-ab759f53443b", "value": "T165A53B556D1FE809028A21C1942BA6A57EDD3B99BD00E44AFF3ACCFDE4109D4B424FB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785218129, "uuid": "58c5304f-42bd-4845-bd82-550a0c8b452b", "value": "384:637373737373737373737373737373737373737373737373737373737373737p:3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785218129, "uuid": "f2869f69-7d34-40fb-894a-d1975d1adae2", "value": 2087166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785218129, "uuid": "be9cd511-5fff-43ac-b1ae-a91748bba28b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785218129, "uuid": "d9697ca0-0e60-4016-8c89-2efae0258699", "value": "Confirmaci\u00f3n de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b563dab-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785211034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211034, "uuid": "54a29065-8583-45e2-86e3-7823e47f5611", "comment": "Malware payload (Mirai)", "value": "6e61764187bdd7436a7bfd0d5ea241a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211034, "uuid": "ae986864-778b-4941-87c7-eb7cc4d51959", "comment": "Malware payload (Mirai)", "value": "ef57e9389ae101e09af861d51804fa6667d6404ce823919b9ee8d5fd2edecea4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211034, "uuid": "3dcabb58-f788-4736-8a22-5cfc7cd06e23", "comment": "Malware payload (Mirai)", "value": "5d44a1104c5a9ee3cc5c290092c810bf9b8b3174", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211034, "uuid": "3129cb05-0afc-47e0-80e1-d19c67e261ea", "comment": "Malware payload (Mirai)", "value": "ade9a161c6bf7c866aa458b5b258ef3dc968a96cd19ba83cb85ae177d4c4f671b9d50e69df8821541fba09d7c03c8bee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211034, "uuid": "fc42a472-b483-425a-a18d-11ad6b3ea367", "value": "T14124230C2971E81BE8A74B30DB8FEF51AF68917BF7CC6454C2456BC05985CEA22D684F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211034, "uuid": "2b62dd54-fce6-41e8-bd38-7631fdbaff03", "value": "6144:N8RuKDj1WEdpFXNYJpWewgukKj/Ozac1ZEcWfvxSTZay:eRzj7vWPUV/OzB2vxSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211034, "uuid": "78aea077-316c-4d08-8274-c0cdab438300", "value": 215832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211034, "uuid": "770fa3ae-0907-4b5c-81ae-e789a8be7ecc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211034, "uuid": "8415eeab-0be5-4f76-bd1f-ab6ed754d024", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d602fad3-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221092, "uuid": "19d7df5e-ebf0-453c-a3e8-455aedc7054e", "comment": "Malware payload", "value": "f0f29732d014bd8f3d9c85fb2cc160e1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221092, "uuid": "58438c56-8b40-4aeb-834c-36dc0e1b658b", "comment": "Malware payload", "value": "ef81a420b82e3e5487a6e118272974d031a1d834151628c37f8359b23355ccb6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221092, "uuid": "ec7e9920-7689-4cea-8e26-9349c79cb5a7", "comment": "Malware payload", "value": "182661a69152a1e9ca29fe9d60b4132da537f4e4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221092, "uuid": "651d05b8-3e5d-4ef5-ba58-77b0bced4d6d", "comment": "Malware payload", "value": "3616a8af21d02da76d24628ba574cb2513c5a627bece5b53197671cd73516f2acce992bf1b138c2610e69ae53a61d3a5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221092, "uuid": "bb1178e4-3da5-4be2-9378-e5ed73b0b2b6", "value": "T19812AF06D8833109D4CDB166A7731748CA6DC4A8CAF976323790E00D86E7CB68745293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221092, "uuid": "3fba6c88-051d-4100-b23c-41148cb984a5", "value": "192:Xh9LfJDTi81UAj9/X3MAaIwWCKpNUp01btAk1SryezWd2TS8QuMkZWot:Xh5J3i439k3IwWCKpNUy1J1S2AWd2Gzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221092, "uuid": "2171ea67-69b8-4be8-bf23-2105dc9e9397", "value": 9265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221092, "uuid": "db3fcce4-41e0-45da-b834-8c5db2dedaa9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221092, "uuid": "1991e0b8-a02b-495e-8cf2-cca41677e07d", "value": "images_20260727_143453.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949e973f-8a8b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785246752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246752, "uuid": "128f9373-17f8-488b-9aef-35a0c44d6ea7", "comment": "Malware payload (Efimer)", "value": "700f8ae06cd33b7ae8d5e7d10b168f0d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246752, "uuid": "4aaa78ac-f44e-4d15-a094-30419ba296c0", "comment": "Malware payload (Efimer)", "value": "f1364dc74d53b9ea08064172a21cabdb9fca69e78884c01799abafd1bd864ef1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246752, "uuid": "06e162e3-cc7e-4e9e-8909-8a03afbd4bc7", "comment": "Malware payload (Efimer)", "value": "2b09ed72a1d286345ca0bcd6156170f05698058b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246752, "uuid": "b711dadd-5caa-40b9-ae0f-c10f31a995c1", "comment": "Malware payload (Efimer)", "value": "afc57ea671f15c2afd358949d5606a9fa6679f58e0169ffc06f5fad213b64310fb9bb14847bc9c0037b331026d67870c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246752, "uuid": "8fcaf010-e196-4d98-a4b9-c179e63582d8", "value": "T19FE63318A9D027FEE5A7923CDEA0438295F274621770C6FF57D443356E172E04A3EAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246752, "uuid": "3140903d-acad-4d21-af80-5daaab059d82", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246752, "uuid": "f4885e88-7ad1-4b06-83ea-5c91d6cd3f95", "value": "393216:2oCjXLfJc2D+jkFrGXMCHWUjXDcuI3/PGTAI:2tDLRRDL8XMb8XgH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785246752, "uuid": "e9221a26-37cd-41cd-a589-dd4b52d4e94f", "value": 14283447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785246752, "uuid": "c48ca811-e7c5-48b9-b2a4-31a0e6a40530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246752, "uuid": "695c3cf1-ad4e-456e-9ff7-9efdf8e46c3f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0af8d4-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220781, "uuid": "38d1ecb2-849f-4029-b1c1-9c0ce2d21fd5", "comment": "Malware payload", "value": "53f0633f258632925ca0853f26b18ed6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220781, "uuid": "219b9a45-d7c7-46fe-8bef-e35730fd1b67", "comment": "Malware payload", "value": "f193e05cf6c8f63ab8287ba52f61e98114e4b34695e0d38870dbe50943a31381", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220781, "uuid": "70432d49-9538-4a4c-bdd6-3fe7b7ae70fc", "comment": "Malware payload", "value": "ba06007dc9703301374829440dafa0df47a70da2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220781, "uuid": "4416edf9-afb2-40ce-8fc9-cb2140c1e2f1", "comment": "Malware payload", "value": "9890dbd6b5ebd50f4eb2803dc503dc7f8aea28673870d0ec667efb412f8120074435e1f1a3bae5b6e2573d182a0567c6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220781, "uuid": "72879db0-1fa9-475f-a6bf-9230ffff24a7", "value": "T13242C0AA7F360DF6E4233210AA5B90100B7B3C634F25943065B00D652E293EDB75157F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220781, "uuid": "8a24174d-0c65-4132-93f0-9e997e1c1757", "value": "192:Wj5ZAvEkZF5aP7H0WdAFGsI+56682HBwKT2QhRcJMppfxR3OifUtNk:85ZA8kH5azH0fFPI+M682HKKT2Q7c4V3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220781, "uuid": "7162b291-f244-4056-96a6-c652adf304e6", "value": 12223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220781, "uuid": "bc752ecb-c5ac-41bd-9d6c-40463bc724ed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220781, "uuid": "1bea6519-0e1b-402f-b019-0f259ac33874", "value": "images_20260728_063006.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240fdb14-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233249, "uuid": "34e00db1-3bd0-4870-b05f-e4172027e422", "comment": "Malware payload", "value": "f1aeeb958eabb3255e58a224290a37d3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233249, "uuid": "6666888a-0531-41f8-8f66-cecd295d52bf", "comment": "Malware payload", "value": "f267dc29f50050bb7abf669b8a8a1cc422b0d88f36257c38a88620da8d04363f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233249, "uuid": "ed7b0183-9a5b-4f85-85ae-e7f700a3c539", "comment": "Malware payload", "value": "b5be1cf720f547e8625efa8bf2a41746e6ea562a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233249, "uuid": "a1b15452-1a88-4211-81ce-23d788ccd903", "comment": "Malware payload", "value": "f66ac00739f211cb3dbc6cf305da8127724a718a1d7301363293ec19e94ffd27a4190f5785b6c0d51b62864ede1fbda8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233249, "uuid": "62ef7308-985d-4e37-981a-923cc88d656c", "value": "T15931FAC95B63D02FE8EFEE3108670F651783AC4AFC425417AA9C121DB6683BF4C43199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233249, "uuid": "bbbc4400-371b-49bf-b643-f93c0b05278e", "value": "48:9KqVNTs5bqMWOvl1hrTjWUQwxD6/QioD2at8dx:vVNQ5bXhV2ixu/4Ax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233249, "uuid": "1824cd61-ec87-4463-921a-43c97378de1e", "value": 1684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233249, "uuid": "69a1954b-e9e2-41d3-96c3-bb916a74f85c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233249, "uuid": "d5f2e3db-829f-41fb-b9e6-fc8803182bfd", "value": "images_20260727_230655.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78097760-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785211056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211056, "uuid": "f4035115-1612-4010-b543-076b6a3a38f2", "comment": "Malware payload (Mirai)", "value": "843a326dccdac3abded615a4a347292a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211056, "uuid": "f2c456a1-7540-4478-a94a-b01b3ec73868", "comment": "Malware payload (Mirai)", "value": "f3ae92c7ac6a714f2eeec0e410a1a7a9b7738ce45d236e9a1032a74ac007ce75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211056, "uuid": "63a9da23-931e-4350-a068-a8cee4e56b46", "comment": "Malware payload (Mirai)", "value": "433231fdb96c148e8bcd80910ab7b92d37525e03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211056, "uuid": "baceba8e-1fb8-45cf-8f95-b63fd9f649af", "comment": "Malware payload (Mirai)", "value": "e405f2f8d74135e4759cbb569205e847d7a426a4c1369c1361869b012d6c02c2077835782b569d48663ffa11ce3f6d6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211056, "uuid": "4190f1b9-c2a8-4521-a260-5fb2c3fedb4d", "value": "T1BCF48D2BB2B2B1BCD01BC03047DBCAB25531F47526212E7B27C4DA353E66DA1175EB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211056, "uuid": "9aff8d8d-6aa0-4bf3-a46d-0bf04c947bd0", "value": "12288:lDSLimZ039NE0axiNgFjDtMd/HJ3janMZyvFD6HFayUStHX:VSLic03g0uiNgFXcdZydD6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211056, "uuid": "05e31706-10e9-4fff-a611-c8ea1dc35520", "value": 743256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211056, "uuid": "fe39e783-8060-426e-91fe-712d8c474b27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211056, "uuid": "9114debc-40f9-4bdd-bd10-ab10e8fbb815", "value": "bot_attack", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238bb70c-8a8b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785246562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246562, "uuid": "bef6459f-515b-41e2-bf0e-1763cd63c9ad", "comment": "Malware payload (Formbook)", "value": "a5d33511793358b1a674ec8605a40922", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246562, "uuid": "6f66bd7e-dca1-4389-a299-803853f20694", "comment": "Malware payload (Formbook)", "value": "f4a571122781401287a14174a51b990419b7ae70c87eba904b041eef080b1a31", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246562, "uuid": "12e76a2e-c47f-4567-adb3-36746aaebad4", "comment": "Malware payload (Formbook)", "value": "3ac73b67d6a46d903aad5571950f6ef79153517b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785246562, "uuid": "827bbff1-1b6d-43fb-91d6-da7c5a5a0cc2", "comment": "Malware payload (Formbook)", "value": "d7a0d3e8420b7f6c9cb52648bf181620e327c01e98c7092a65289a7e43f12b0f1320d2fc3b953cd8e82fb5dc03124b91", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246562, "uuid": "378f8c51-5772-457d-90e0-3cd0feae4cf7", "value": "T175A3EB9559877080637777BFB32A98E5E3AA072B0240181BB87C7450DFF2A09DDE4DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246562, "uuid": "0146ecf3-3758-4e73-bc70-427a40b31c61", "value": "1536:BjfUEe3pCm5sC9ry+HHd7YReq8NQ5MxH4mpwXOCaucTsb7eCu:FsNjy+HHYC8aqba1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785246562, "uuid": "f63eba1b-e02b-43df-9483-eb3f81f7af5a", "value": 103200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785246562, "uuid": "e4e928bf-b2d0-4482-b4a0-052623b0db15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785246562, "uuid": "93a5efdd-95c8-4cbf-be17-68969c0e5ee7", "value": "MV_ARUNA BERK SAILING ORDERS pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de907392-8abd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785268351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785268351, "uuid": "4c38a8d1-6e1e-4474-85ca-64efdb658f9d", "comment": "Malware payload", "value": "219b5d691744d7a98c8b4df067b0b136", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785268351, "uuid": "81f2e24e-44bd-4cef-9ad0-00667a7cdebe", "comment": "Malware payload", "value": "f4c32b3f9a949e5a17ff0b8ad130ba5ca15e5d9a037c7a97dcc68a6b4c3212f7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785268351, "uuid": "8cd72184-ffe5-4426-94e9-bb75e3db22c0", "comment": "Malware payload", "value": "8587723e626cb2b73b27e79c8828abe8d5bc1996", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785268351, "uuid": "f64ed718-e726-4703-9743-e103570ede31", "comment": "Malware payload", "value": "67af4751f4049119a67c4f7fd84cbf803385cd36bbe35a86543228aabb683a873cb616cd745b25e8199be334c09c586a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785268351, "uuid": "67d3b6d0-cbd6-4af0-acc4-6a82bcf2682c", "value": "T140E63348B7E492EEF5B3843CBCA160A5D5A4F8734732C5DB4B6883B2AD172E04939753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785268351, "uuid": "e2d38f90-4248-4e54-9ec2-ae437ca3617e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785268351, "uuid": "5255edfe-da46-4dc2-81f0-290dd695924e", "value": "393216:ELZKsRWVOpGJEst1yGXMCHWUjX6cuI3/PGTAI:ErWVOpGuI1TXMb8X3H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785268351, "uuid": "8e154977-bb41-4d6d-9822-5bf1f0ccbe26", "value": 14325445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785268351, "uuid": "24e686c0-3660-4751-a371-482f90871589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785268351, "uuid": "75ab9ba7-50b4-4858-a61e-83228727af5a", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d1955a-8a99-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785252787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252787, "uuid": "566a8d63-51cf-4197-ae4b-a44e444f73bb", "comment": "Malware payload", "value": "8ff63e972579b1b59123d5cc0e75f638", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252787, "uuid": "841e1724-20ac-4d22-99bb-7079af830957", "comment": "Malware payload", "value": "f50cfa8aa6311705127f82651206401ebb3ec1c12baf6191b0f3839fe5211172", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252787, "uuid": "74a56337-2196-4317-8726-6503fb29d9e3", "comment": "Malware payload", "value": "d98e664fcd046075a9225b94020b70f826fd077d", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252787, "uuid": "7c2900ba-11a3-40f6-867a-dc756e3ac299", "comment": "Malware payload", "value": "e5f996f647d2baafe1f069dbf9db928bd6bd8f5e280b83b5a6093a00977f6620117f9e86842060270618268f1e76a213", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252787, "uuid": "667f3a27-cbcc-4513-8484-c19028f4dc95", "value": "T1B3C1FCD58882D0136B6EBD0AEB4279CFD2701FA3E44856CDA9746A4D87EC09DF4ED8C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252787, "uuid": "d1595d14-16d3-4da2-af54-3d407f2dc672", "value": "96:rFT0ykBMijvilT9t/BY69HjwLYm5IPkZpYxH8rBjlNrkDjohYtCsW+vLzsqZ0MbV:JLkB4lTvBY6BMLYm5IPCpYxH8rBRNrk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785252787, "uuid": "4f665c93-52f9-42e4-91c0-f6d19cc20845", "value": 5983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785252787, "uuid": "266d8cb2-ad8d-4502-b6b2-e6e6fcf5dcb5", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252787, "uuid": "19cdb569-9c48-4c69-920c-95d22f6d5d54", "value": "index.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039b7237-8ac8-11f1-bd95-42010a9c0009", "comment": "Malware payload (WSHRAT)", "timestamp": 1785272708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272708, "uuid": "fd6c121e-9972-4eae-81c4-5d1196d1878b", "comment": "Malware payload (WSHRAT)", "value": "14993e1b390800b0ac04e9d47b800c87", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272708, "uuid": "bc4b8155-ba69-4fbc-8efc-8b60a1b625e2", "comment": "Malware payload (WSHRAT)", "value": "f53377f1c4282703ee09bb8123cc93932f5eb282936551b1379ba91e8df1228a", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272708, "uuid": "f4b9b263-822e-4c88-936c-9309beb2f984", "comment": "Malware payload (WSHRAT)", "value": "64a928fbab046e707c9a10473887ecff6eb70a60", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785272708, "uuid": "d4613f8f-dab4-49c9-9d11-347e54e56e20", "comment": "Malware payload (WSHRAT)", "value": "d8b0dd02354a5eb820bbd8e4c9bf65badf3dfe7a31422ba0b628e1636fefb7d62ad6588498d20d20c79a59820158d62c", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785272708, "uuid": "42d87993-6b78-4f79-9a4c-351dbab2c9a3", "value": "T1D394E53C83D3D4DAA0CBA76EF653A3C64A14E36365D16A70AE6273B0647044D7C8D2ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785272708, "uuid": "739c25d0-f871-4df0-a25e-0be39ac75ab9", "value": "12288:j8veDAHhRfukVFB/MlLOMPzr9b4i0Z/6ZQC8Z99B+rdD6yMcGhvPoxMWAyGMWnNW:j8veDAHhRfukVFB/MlLOMPzr9b4i0Z/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785272708, "uuid": "c1e9b3f7-cbab-4823-a663-d89c72261be0", "value": 429839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785272708, "uuid": "27eb7014-7ab1-4b1d-b9d4-325e6cd8dd7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785272708, "uuid": "9f559a9a-e001-4e9e-877d-2099fa813bdf", "value": "ORDER-270728-200878.PDF..vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa8e07f-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221153, "uuid": "ec9bbeae-818c-440e-afb9-e0ec87ae4349", "comment": "Malware payload", "value": "a27ceacded02f83ef38b91eeeba169de", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221153, "uuid": "c35bd927-38a6-4398-aa8f-db48a2f10a5d", "comment": "Malware payload", "value": "f5458cdd0c7e59010f630e60367c462bde992beb74e3583363bea195b73d91e4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221153, "uuid": "8cfed23e-837f-417c-9ff0-71d3d01c29a8", "comment": "Malware payload", "value": "369b4df4c789bef937267cb0b3b7a860811c7e00", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221153, "uuid": "d00c292f-0494-450b-a7f1-6e10582c1696", "comment": "Malware payload", "value": "c0eb74807d8c78b8adbc44b0d0451fc02d772a53a16d83cc92dd642115c20757ce22eec5d2e5043febcc1fd622883493", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221153, "uuid": "08512902-0391-4054-b1c8-8343229956f5", "value": "T1DFD18CA4F98D94159AF6D1FB2CD918AD02BD2E646067643FF318124824BD60AA2D86CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221153, "uuid": "001461ca-0a91-4160-9951-0eb03da818af", "value": "192:bhVOHdAk/Xyej5cO2S3zSdkmtQYPna7aNwRb/D:NVO7ieySDSbsVRb/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221153, "uuid": "6eff5290-dfc0-4b2c-82fc-44494f1acacd", "value": 6221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221153, "uuid": "6a36df4f-0edf-4ba4-b69d-b4459709d1a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221153, "uuid": "b4e70c4e-5748-4ac0-b05a-972908e28b13", "value": "images_20260727_172522.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ddf573-8a79-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785239186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239186, "uuid": "f7c82475-2c25-4b30-a7ef-bbe29971d3d6", "comment": "Malware payload", "value": "57f99a915216533982ca524996da615e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239186, "uuid": "e9abca56-61af-432c-bbb2-b1153180953f", "comment": "Malware payload", "value": "f602b76aeb430fd77e90580b6adcff6e6e042553a86cf7ec9bff91baa2082d44", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239186, "uuid": "a4dc06b3-1c52-4ba9-a468-7b8bb6c44127", "comment": "Malware payload", "value": "12a0339a2af98e56bd6ddc89c6ded3a6a30974c4", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785239186, "uuid": "8c61f466-6671-4008-a299-f753020b28ba", "comment": "Malware payload", "value": "a2104db6afdef64aa297701e5f85ca1a508f3cd1595af5d10606d9da4d2a20016f64867ffe244c3902d2ce1bcf69a3d3", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239186, "uuid": "61314d47-7dab-416f-adc0-a341e0ffa5a5", "value": "T1EAD52383F771A85BC8EAC3371164263A147A5D258343F78A2D5833FE68F79E84B856C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239186, "uuid": "36f3592e-354b-4312-82af-12f78c22ab94", "value": "49152:RCrvquSctoH+NeMveyCMg93kbbafPQ85O4rPnIl+kENcbFkiS5d63+heel7p5nrw:RCDFgeNeMv2eb6L5O4D/kMUVasOh995Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785239186, "uuid": "d0858b49-a9f9-460d-a670-df7d1c9de2f6", "value": 2899212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785239186, "uuid": "cdcd9c89-e58f-4b4a-b85b-867fec200a4e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785239186, "uuid": "517306cd-9e9c-440f-b720-25beb3c76320", "value": "edlir.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7671acb1-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785211053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211053, "uuid": "424cf7c1-f8a6-42e3-856e-0411181bb68a", "comment": "Malware payload (Mirai)", "value": "d2879ee72df96b33c80d980da5793e0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211053, "uuid": "9f884a66-9b8b-4a15-bc90-35d6ab069c17", "comment": "Malware payload (Mirai)", "value": "f65b73622f2228525a059662c909c97bc2ff655da409cd915de5841d0d30e537", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211053, "uuid": "d889a85c-eba0-4440-bee1-f8f0d263af60", "comment": "Malware payload (Mirai)", "value": "e62cab6da82cee6ef77d3c74c6d956421e06d315", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211053, "uuid": "755220c5-78c0-4bb6-90a6-fd32231d232a", "comment": "Malware payload (Mirai)", "value": "00ffaac52aa60eae47a9524a1e05bebc6e5c33e433c50a813f1a074428d4f007f5b966dcd74c69fa5b931f0586ca8cab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211053, "uuid": "09b2fb5f-a0a9-4aa7-8117-2db169b31aa0", "value": "T182D58D17BCA005A9C0AA963289A69192BB71BC490F3123D73F90B37C3F72BD45E79754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211053, "uuid": "435cffa0-43e4-48f4-993d-bb5feb32a3d0", "value": "49152:U+Nc/77J8eI6w7d5g7lr6Sgz69yGsbRZkUbuQ:uzSx7cr6vbGsDjaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211053, "uuid": "9f243ab5-1f34-45fa-84bb-d62f28541035", "value": 2895080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211053, "uuid": "9aa28638-bcad-40e7-830a-79eb2c90e20d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211053, "uuid": "56f9b6e2-c1de-4119-b2c6-a27955644510", "value": "router_exploit_v2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86239f05-8a54-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1785223105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223105, "uuid": "d8bdc4a5-9fee-4c60-b965-cc666e6ee687", "comment": "Malware payload (VIPKeylogger)", "value": "381c5d5ddd743a765aee88f72458dd84", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223105, "uuid": "fe405ccc-cab4-4ccc-a0a2-737aeb717ebb", "comment": "Malware payload (VIPKeylogger)", "value": "f6868efc5e41f0c190fc0c682a2af9fbdef33a3c4909f68765d45f51fda36833", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223105, "uuid": "fb309230-b762-4f04-8406-d1448a478a96", "comment": "Malware payload (VIPKeylogger)", "value": "665d982abd8a24e17857181f3b0e5f8ad60a2ef1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785223105, "uuid": "48ce28b4-ee31-42c4-8de4-8fbeabf7d4dd", "comment": "Malware payload (VIPKeylogger)", "value": "5b62eec2ea82c2eb6658d7cc107a6610dd91afad182809a5ef00654fe67ac71938a621ef728fa9e0c66b4c790f0d1eb8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785223105, "uuid": "a9378bf8-caf4-4cd2-9d6e-00bec5b0baea", "value": "T1FB06E68C88A2EB8BD4E896145FCFF68407598613DC28FEC7763F55E49B48EC1A34461E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785223105, "uuid": "655503f4-e771-4937-8fb2-9dbf8533ac34", "value": "98304:iGbPxmTdrH5cx6mTwqgx2v2CH1RaUFIWWKlc941MjPUoCf:iGb0dHux6mNbOWraJD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785223105, "uuid": "c1805772-9478-4997-b6d2-8f511e198c31", "value": 4006325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785223105, "uuid": "5d8d13ab-d0a3-4acc-b3c4-784d69e1c076", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785223105, "uuid": "2e2941e3-ea09-40d9-bcc5-f39094e85dcf", "value": "nvybatoi.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b3e6c0c-8a97-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785251756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251756, "uuid": "fe4e06ad-d0f6-4657-971e-64ef22165992", "comment": "Malware payload", "value": "ca5917ebd00d907448ecdf3016c69621", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251756, "uuid": "42995d4d-e4bf-4ee8-bd7f-918601d54bc0", "comment": "Malware payload", "value": "f6d6a8aa8c5951d4f536c578e470176ca1c35c401f0df0d5c617c3fb4a1bf9fa", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251756, "uuid": "101d4e29-cadd-466b-8e1e-84d1e51a25aa", "comment": "Malware payload", "value": "be38c976ae085a0accab8d701964e683554ceead", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251756, "uuid": "1dcd2631-3854-48ec-8da3-13520e584a65", "comment": "Malware payload", "value": "b1a0e4f93aff348cf8efe0d7342b65332ac9cde20c75f3e9ec867f38294789a8909a7a21fb1161131a928ae7e19bbd04", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251756, "uuid": "e84f9afb-0736-456b-8f14-72af162e42a8", "value": "T1E1C18D344D05C2D9C4682ECEC54322C450F8F8D03975A5878DEB725B7D96DC6268EAA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251756, "uuid": "e4845f65-e9ec-48b6-89ef-d39b0d296a90", "value": "96:TyZRPw5Y//9YbosRtKKnuuYWNZP27VXpfVCFJO2kS+6hzNHrY2UjmjbgxYzN:uHPwK9YbXDRh2Xf8p+6hZHc2pjb+Yx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785251756, "uuid": "a177c692-3c0a-4387-b74b-a387fa19267a", "value": 5651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785251756, "uuid": "ffc2f079-5bc6-4f2a-b6ac-a73b4d9108a9", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251756, "uuid": "f28f026d-5b9f-47db-ad12-57ec1a5981a5", "value": "c_6a4231612d611.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c103e6b-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220887, "uuid": "31ceb891-b492-4417-bfdb-30586cb89643", "comment": "Malware payload", "value": "c7192fb1707b6a5ed3faba773562715d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220887, "uuid": "a52b9f1d-d9eb-48a6-a559-d1f83c897059", "comment": "Malware payload", "value": "f79d7653e598fde93faee03fa141f18bee6617910fe7569ba0917d8244549f37", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220887, "uuid": "fdf5c99d-85f7-4ab2-80c0-b7ff6fa80294", "comment": "Malware payload", "value": "0c7faf0f066d7e3809d66ed48919ae182af095b5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220887, "uuid": "f0bdffe4-b063-4d79-81f6-7e3da9720360", "comment": "Malware payload", "value": "9508217f408c388ef98ea8f6d8c165105a95044ec34b1be843c335d8bab6d0815a08ed12344f4df829bc63ebee14f5eb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220887, "uuid": "ac696e96-2650-4e13-ba92-c6d8f3280e33", "value": "T17F32C0D38146CEDA8F77E0B3FBB26F502E8A766136339B4BF8D0588D00994417D23062", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220887, "uuid": "7468d1c6-89d5-4dc6-8e77-ce09d750d7c9", "value": "192:hSpRBR/74//viQjgD66kcIqjipZWk/BsfgyQ/JhaQOESlDlMgW7SSM/7K:EpnRTghwOqjipZl/Bsfgz/JhaXDSg+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220887, "uuid": "1f3a27c1-5e3b-452d-ae77-3de994fa5ed9", "value": 11777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220887, "uuid": "430c3968-097f-486e-8d15-0b43813603c4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220887, "uuid": "ca287a76-fed4-4250-87a7-993a00f14543", "value": "images_20260727_074311.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bbf9416-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220806, "uuid": "c2dd39fd-e858-44d2-a1d9-779e241fbf31", "comment": "Malware payload", "value": "57eb22134bf6f899cb61e92fd103e0f1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220806, "uuid": "a6a70b6d-3b24-49c1-992e-de61e6dcb444", "comment": "Malware payload", "value": "f7f71e83deecdfab2586c6ece5458bb1d48dc8a85f63b8249e7369a1594c8a81", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220806, "uuid": "6d1d02de-a514-4b40-9e3d-e598b8f5d0a6", "comment": "Malware payload", "value": "ee75d2a6c38c53cd3cce6d791e94320b3c6b43f6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220806, "uuid": "96949aab-5e86-42dd-8321-ab8a93d8d7e6", "comment": "Malware payload", "value": "a9b3b12792baea26cd40d6218cbf01bb1fba6b032c366ff8b5b65470262334dcf9566af056159feab5c3358e8eef8233", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220806, "uuid": "385e3ff5-aeca-41f8-a177-b3bbf510ddb5", "value": "T1C472D0DDD8D6A435B887ABF700FB4E3176008D0B4E42B9104EB631F7D2F422B4EA5616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220806, "uuid": "57934dae-e707-4798-ad68-7c2a0244c87e", "value": "384:LsSX0uQqmu/6BnaOJnMHvY/nJ08WsXneH/BT1Zo9mZ/b:LsSEuQwCBasnMHvOJh5XO/91Z/ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220806, "uuid": "c0b63c01-08b3-4e26-86aa-2562713b1d06", "value": 16006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220806, "uuid": "8353c240-8d47-413e-83ec-ad074470f703", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220806, "uuid": "bcef4568-0faa-4cd2-90fe-e067016cc3f2", "value": "images_20260727_071913.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a8395b-8a4e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220722, "uuid": "a16d43fc-0cb9-4a03-9d44-0cef15403c67", "comment": "Malware payload", "value": "9c3e6f8e33448dcafbfc865847cd4b6c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220722, "uuid": "2dd8ea6c-6597-40ad-bdac-7fe8b551b73e", "comment": "Malware payload", "value": "f7f8334d1ed54504d07483824e35ab14fa6a544b0a16dc3a89f9bb3fcb8367ed", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220722, "uuid": "98fc8c0f-3b42-4b55-8bc4-bbbaba9c5086", "comment": "Malware payload", "value": "9333e3b7fe96398e18f13feb002734d42bd7deff", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220722, "uuid": "b8b506fd-5761-49b8-94ed-b6afe6f7c6a6", "comment": "Malware payload", "value": "b879902b028e9ea3a931491e0359fddde92b1fcee12b8a3943fd2b4eba46f07ccf291318426a4ab30f6d864a3d96d06b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220722, "uuid": "3affe404-08bf-49d8-8538-865f10de4d73", "value": "T15B72D0B9838D662BBD15C51A3AD81F6A4B65F0303715F47333F840781588FBC2D21A68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220722, "uuid": "65b425c7-e909-4147-9342-aed1d00d1cce", "value": "384:KUW7A0m3+Bk8oVuVnMKcqitg9gq1DPqcFlN11b/T:2Sp8Z35icFTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220722, "uuid": "2467f63b-af8f-4175-a382-8c3859cd7568", "value": 16323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220722, "uuid": "15b882f5-a255-432a-b7b4-4125a483816f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220722, "uuid": "55efc9ef-97b8-4c45-8005-a5229550660e", "value": "images_20260727_132634.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b50a0b-8a7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785241544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785241544, "uuid": "22b7c0d6-a2c7-44da-b67e-057fa27cc354", "comment": "Malware payload (Phorpiex)", "value": "2c6cbec4eb4b6fe7442effcc933e71d1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785241544, "uuid": "ccebd961-c48f-48e5-9d35-1a31712e1b8a", "comment": "Malware payload (Phorpiex)", "value": "f7fc3b0773b7c63939174cb2db2a6f7fa645e8c3251b131a5ab071f2d293d87d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785241544, "uuid": "85a66f8a-fcd8-4538-89d2-87c4a1633677", "comment": "Malware payload (Phorpiex)", "value": "f08963c742b50266246c096f76929390aca226e8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785241544, "uuid": "6fd66922-890e-4ac6-bc7a-5eb06abbeadc", "comment": "Malware payload (Phorpiex)", "value": "b40da34b4658af73d0dd5f06551d2f3bf6865711110e6b0605e3b30e6148e24c211c115638965f2b616ed66c95f7494c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785241544, "uuid": "b880bb5d-a6c4-4b50-b9fe-f466b624a39c", "value": "T108623A0AA4818035EAE04075827F526649BEADB623C4F9D7F7E0A8CA49B4BD1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785241544, "uuid": "fa8ca0fc-dfe9-427c-a291-77ed9e020fb2", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785241544, "uuid": "0c742819-b248-4242-937a-dc71f2e77e0a", "value": "192:AW7sGnjXgjk8LcRI+Q1RDMRYfV/F5oIVUBKUSftzQFBrfgJxTmv8U9cthH9ik:A6ScCRfV/ro6toB0av8U9cdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785241544, "uuid": "96589690-612f-4bdf-9492-c43bdd64e780", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785241544, "uuid": "2ccb99df-e42a-44fd-bc47-05ca996776b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785241544, "uuid": "e67ee1b3-a0b5-453d-aad1-212f38c71af0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7abedba-8ab4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785264393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264393, "uuid": "1c3aec22-8531-4d4b-a6af-e5fb61321ff7", "comment": "Malware payload (Mirai)", "value": "11f63a6bdc877d4d13f3e1ede033c59f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264393, "uuid": "d19ad674-84c0-445a-8bca-18018292eef2", "comment": "Malware payload (Mirai)", "value": "f80e14057062c1b9b24819c8aa524c6fa7991a720bfd15e784d0d21f7a78c2b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264393, "uuid": "86aa22af-5a70-40b3-84f7-8136ae4ff4e8", "comment": "Malware payload (Mirai)", "value": "14905d456ef4662b56b909b131c11f6e13b5ce93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264393, "uuid": "ba388379-5311-4f59-892e-62597d15e9f0", "comment": "Malware payload (Mirai)", "value": "f2336a4ac596518700a42e05c2df51e1d3704f8125b300c9dbfbe39ab3f3bced7ac613c4a9053e852fe88f18212a3fa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264393, "uuid": "adeafff6-52a1-4d64-b129-da0a854a5f34", "value": "T14BC30745FC509B16C6C611BBFF4E428D7B2A1758E3EE720399256F24378B86B0E3B146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264393, "uuid": "12ea48d2-30cc-4727-81ae-2d637205d1da", "value": "1536:3l9m6vQ0GWkXB272F5Yr4VxhPT8j7r3t6gLOZZzqGuAMlflkKwywla+YTu+xVSLB:GfpR27t41Pwvr3ESGvGpbKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785264393, "uuid": "4970853d-0a28-4526-b261-f1ccd090dc9f", "value": 125292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785264393, "uuid": "f01e4d92-b175-4304-ab2b-ccaca7b573c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264393, "uuid": "2569812b-3fb4-42ac-95bc-e70191faefb2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36386c28-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220824, "uuid": "fb892f8c-204e-4f58-9180-17fd605f72af", "comment": "Malware payload", "value": "1e654d896a1fe44e2e66878d6acebb80", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220824, "uuid": "bdd8cdf2-3a24-4a64-b52b-a49a97d8e7ba", "comment": "Malware payload", "value": "f8851e701a2e7305d10eb6e784291242423817ac47aa6949436bf84604c84738", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220824, "uuid": "5f75b40d-985f-448c-9e72-d949f9c714ed", "comment": "Malware payload", "value": "cfd3446452d0290607fa364d0f40bf4c31640467", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220824, "uuid": "03c83ea2-e3b9-4cf5-a256-7a722c11b76d", "comment": "Malware payload", "value": "2323ff4b78b6a4c918c644bf7e7bf7b805229dc33a79de747bd02b2f2d65ffc1d2bf1accdc512b1ad174c9c6f5f61639", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220824, "uuid": "85c900ff-e3d3-488b-9f10-15d2002f9a72", "value": "T1CD62C0D07E581524CEA4597090B33B91F7F4B0C18A0069327B6D47E5ABF7B620F468B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220824, "uuid": "5688a772-1556-49ea-a9fa-8d5d5b36b52a", "value": "384:YOKlItKcdLdkAF65Ctxr5zk8hzUXKBLumzJr9wlQ9:DymKcdmAEMRhQJsJrv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220824, "uuid": "91210090-d0d7-482d-8a22-1bb526f09a20", "value": 14982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220824, "uuid": "14a89f3f-c6e1-4eea-aab4-81d78109d33b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220824, "uuid": "6da53b35-7898-428a-973e-4d43ebda345f", "value": "images_20260727_215948.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca0cbf1-8ab0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785262657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785262657, "uuid": "5aba28bc-0f54-440d-9841-8442e86584f4", "comment": "Malware payload", "value": "2ec5a4d805472352a10492d311a80fa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785262657, "uuid": "b7a75ca2-8a65-426b-8d02-a78317f3e752", "comment": "Malware payload", "value": "f88d9094a90f7000a3fb2cd7c981e03357ce2b39df9de5ee1d0742e619e3860f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785262657, "uuid": "db68a2b4-9a9f-4235-ab68-25bb2071ac1e", "comment": "Malware payload", "value": "da190ccb0e6cdb6b55f40532a0ee7064d31ba760", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785262657, "uuid": "b15defb8-8776-4fac-92d0-70e81ba6a457", "comment": "Malware payload", "value": "a89f92a7db40f3e528a7a603b532f250035bc0b1cdfd4db3c84cc978e6803ebc110fb707041867c31e3b71c661582e39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785262657, "uuid": "d31a18bb-7749-4350-be8c-34effaaaf0aa", "value": "T171469F606E5859F5EF8C690E90AEAF1D83F042176A33706BFB41DF05BDDA241864B21F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785262657, "uuid": "2d46d766-01b1-444d-a2d0-3767d3e25e75", "value": "24576:QYuC2NrO/LXTGqatNo3sk/mUjIo/f8YpQneRZQ5msYFFXNBYWuXT1I365ZaL47Hn:75J0r+D93O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785262657, "uuid": "e29dab43-e43d-41ec-997b-42971e5f8e4d", "value": 5506178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785262657, "uuid": "b4bff9df-51cb-4806-830c-b3ef8a5970c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785262657, "uuid": "711851ee-5915-43f7-968c-8b57ebbfddde", "value": "Bank account details.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714c3729-8a1f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785200307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200307, "uuid": "83b4ad67-7338-42c8-8664-6957e8293519", "comment": "Malware payload (Mirai)", "value": "4f1fc069a739d673e7cb80468adf9dad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200307, "uuid": "3f175a82-79ad-441b-b3c1-87073add662e", "comment": "Malware payload (Mirai)", "value": "f912389499090e12b222ac4800da81a9e8d0ad6765b63fbee9eafc0a4291076a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200307, "uuid": "f4dfeee2-2873-4c92-acaa-c308d7d3e3d4", "comment": "Malware payload (Mirai)", "value": "6b631e14f8a563664a02d9a1d00c426ea6e572ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785200307, "uuid": "cffae196-081f-443e-93a3-5aa7a97eb9be", "comment": "Malware payload (Mirai)", "value": "e0eaf6e33abb0002edb2fa40a41b1d011d841d620e1997a358bdd76358c37e0bbb180b78a0549589adb7a8e1f7d70129", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200307, "uuid": "b25f9fa0-626d-4cb0-afa6-ac046d1ed089", "value": "T1AC93F759F8819B11D5D525BEFE0F428D33234BACE3EB7212AD249B2537C692B0E7B105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200307, "uuid": "89f7fe33-3bf6-4810-8659-0ec9c3d24642", "value": "1536:UZnYL0d3OwMGHMq5g05rt+644caFiBGFaaJp09lEuit0dBj55MbBZTuYHimfn5ZX:V0ptMGHMFkto4caFiBGFaaN90dF55Mbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785200307, "uuid": "68fb1c13-9f38-4b13-96c3-cab884c67e20", "value": 95692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785200307, "uuid": "4ca12927-9d4f-4a6b-a304-3ebed6f81169", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785200307, "uuid": "9263488d-b1c7-454d-abe5-972f93450f3e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30686095-8a57-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785224250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224250, "uuid": "0b950b92-c531-4b3f-a288-63d82bf6c3f4", "comment": "Malware payload", "value": "9d2d22a5c4d808ecccb5160f3fe99426", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224250, "uuid": "b4e2f133-6d8b-4a19-bfcf-ffb86cd241d5", "comment": "Malware payload", "value": "f915821be87fdda75327429c10da4b82c3a3dbff5e31e9a2d6a3f3d9f6fd4556", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224250, "uuid": "66dab503-74a2-454f-a89e-f513d3d479e5", "comment": "Malware payload", "value": "ab10cce2c2e1134e0dbdf4859c059e57237587c7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785224250, "uuid": "5eaffb93-ed94-4799-a4b5-6104ff23395e", "comment": "Malware payload", "value": "dfba78b9e0ec8ea908cb81397b7a731469765151da0ca3ef065d01d3a4937e714016b3db12e72dff2be2f8c6f3ea292a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224250, "uuid": "a3da9e5d-7b7f-47a1-904e-72f536eacf6b", "value": "T161C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D4A3C71DC11FACD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224250, "uuid": "fc5e2549-4eb7-439f-a97c-9e3a76a778fc", "value": "768:bL8vCB+25j6es8RvP9FYpMSUpi+20qUpi+20YQX:bL8l25JvZd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785224250, "uuid": "be9ca803-6a56-45bb-8e1d-47dc42b09bc2", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785224250, "uuid": "0f541cb6-7421-4c5b-b41f-ce9fa00a1c71", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785224250, "uuid": "deffd3ef-dbab-449e-aebb-8c917cf7c7be", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015777a9-8a1b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785198401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198401, "uuid": "038f8b12-1606-4fed-bd67-03d3446fee56", "comment": "Malware payload (Mirai)", "value": "cafa830f1e23156bf3e8452b46beafa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198401, "uuid": "3371d6f3-354b-45fc-953a-20b9c74fcd55", "comment": "Malware payload (Mirai)", "value": "f9bb0caed91dcc9a95aee382b85494510ea4c94eaf4666ff70082b41ef1c0bfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198401, "uuid": "0e40c0f9-b396-4f64-9f55-ff1ac8a8d07b", "comment": "Malware payload (Mirai)", "value": "3dae3c903f95217654ba1573798f945447fe2f5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785198401, "uuid": "64128e19-f692-4746-9b54-2634e97dce37", "comment": "Malware payload (Mirai)", "value": "9629e4d3ce074e9a7ac61ae77b07deac4fa966bb6d8ee3372b400b11334b4cd677f3f5cfae889ecd78047697da0a768f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198401, "uuid": "d24f985a-f6d3-4af2-b411-3de3b6f73fa8", "value": "T154536C8EFA43C0B5FD4615702837DF624631E8756075FB82E7761AB2EC23A01A6177AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198401, "uuid": "ff3e7265-5aa6-4758-9585-702376c75f00", "value": "1536:nHLMR7clhz/WejTNLz/Ve5TX/+nOdRKs9y+a:HLC8flLzNKj/Sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785198401, "uuid": "206b37b5-41af-455f-8a14-429002ce1c64", "value": 62352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785198401, "uuid": "91eb3302-2d45-4cc2-bf08-e780322101d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785198401, "uuid": "0e21a8a9-8beb-4795-bb16-ec2d5f6bbc99", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ee54b2-8ab2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785263313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785263313, "uuid": "f2034894-6ff1-4187-a538-4c1b3ea4d560", "comment": "Malware payload", "value": "fcdf3489e52fd46318c6542acb539113", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785263313, "uuid": "0b995fa2-5f50-4d99-984d-916b1fa196e9", "comment": "Malware payload", "value": "facb03a4bb57c0935aa23e44d0400648abb3299d8799421d3f6ea90d8be07e14", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785263313, "uuid": "e96a58cc-e56a-403f-9fcd-dce1e1a077a5", "comment": "Malware payload", "value": "6812d14be2344c3d191c7220ba0c5bdf5117a436", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785263313, "uuid": "6a0a8093-01e4-4a5b-85bc-eb4cd0144f1a", "comment": "Malware payload", "value": "bd90bb8eea892a880515d4e881fac3faf729d06b946d80ce61310d111e1b9ea0ae97ff7c75236d55ca96a7ed873228bb", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785263313, "uuid": "4e824484-0945-413d-b73d-4a392b180828", "value": "T1F93209CCFEE16270F31303CE37AB2826122461D72008C5C5FA4D9DE57F467D98627A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785263313, "uuid": "08f76293-597e-4a6c-b86d-1d89c70cc595", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxz25JYb55qa5HdrI74bthOO:sXX+/DV7k/325WHqur84bTOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785263313, "uuid": "7feeb71f-c499-4248-9e41-7f663ed05985", "value": 11907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785263313, "uuid": "49a1ab9b-0ed8-4a6c-96c2-ca0ed2512104", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785263313, "uuid": "8898f002-69a3-47bd-9cc8-e352596a341f", "value": "don12089.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0eb025a-8a4e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220681, "uuid": "4dd9fbcb-2fe7-4f81-be54-8b7eb9eb4d93", "comment": "Malware payload", "value": "c9b252814711ad2c675c648d95cbeab7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220681, "uuid": "f1628bd7-b28d-422c-9f03-2c4575827e93", "comment": "Malware payload", "value": "fb0f2418ad5331c6a22e0404f6014382cfe4c16bc784a9bbd9a857b4c67c4ff3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220681, "uuid": "4f5b7951-6295-4c63-ae46-229102ad8bcd", "comment": "Malware payload", "value": "c4652242297f575fc0325529caef5837ce6b13d6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220681, "uuid": "0801ee7b-1b58-45a7-93a1-a63fcdf59950", "comment": "Malware payload", "value": "9357e43ab9abfe0f324e9e284a25c6b4f8c8810c4c5885c106b295734d4187b7f300bbd4b1e46b22380d35f7fa089d0b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220681, "uuid": "8e7477bc-9e53-445b-8b1a-388f31d7c052", "value": "T16B72D0F07F393845A6F7615C2AD939CAD57B099B4A6F190CCA7718D3C6016A830E1DF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220681, "uuid": "004832aa-04a4-40cd-9889-82f31cdbca18", "value": "384:0LVTiXnGYY83CoFf0fNX37BR5oRN6YccxSSZnCGNTS+lJA8prq2w:09iXGYYa5clXtRirccxBUZ+lJBVq2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220681, "uuid": "d01f4d3a-23d8-494a-8da1-8d0e5f780fea", "value": 16291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220681, "uuid": "3679f279-3a05-4b3a-90d4-cc6b819511d2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220681, "uuid": "e19f426f-6ef9-473c-a7e9-24d178ecd24e", "value": "images_20260727_233444.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211af96e-8a6c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785233244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233244, "uuid": "cb1dcfb7-25f9-4b68-ab7e-eee1f06022c7", "comment": "Malware payload", "value": "7fc6b5b7a73134c46016f3b021af9134", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233244, "uuid": "168d9ea5-2275-45aa-b1e5-a961a3a3cf36", "comment": "Malware payload", "value": "fb143ac1c0f086dd9d598a8065bea56a0d9f5c5b4c5a9e6e5acced07736f7938", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233244, "uuid": "760b6936-cfa4-438f-a1e0-867909d2821e", "comment": "Malware payload", "value": "1b11f513cb5e21d8f0133e3dce229cef5e93ec41", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785233244, "uuid": "10f2d396-5f69-41d7-b6f5-e0b5dc60174a", "comment": "Malware payload", "value": "684ca862b71b36328e0219edf6ebdf2d5d225a442460ede0d40be6f958a42b3407547e210d8b71845565de5c2338af5b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233244, "uuid": "d51480c9-aca5-4f8f-8ccf-44909099921e", "value": "T1EFF19EED1C710612F8D3E07272668A4EEF1AB435DBC9040DDA7DA250C21E769E19EC84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233244, "uuid": "4f30f0d9-0797-4997-b533-4b1394dbfd9b", "value": "192:Xbil/kWUGJIVy4is8DyC8U+35rkKmr1DRy6f6asZS9qG3qu/qp:rSkcbjsoyI+358DRy06IxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785233244, "uuid": "741eafde-c520-4bc0-9e83-662224c8215b", "value": 8136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785233244, "uuid": "446e3b61-8ce5-4d41-9e49-87f3c481702d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785233244, "uuid": "8fd4747f-3cc0-497b-9f02-bdf4f33cbad1", "value": "images_20260727_214059.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4395cba-8ab3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785264092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264092, "uuid": "efe6b2da-618a-44df-b50a-07fe93a7a461", "comment": "Malware payload (Mirai)", "value": "4347bfbe25d3c5410d3cf3c4b6684024", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264092, "uuid": "4493c534-d8c0-46e3-bd70-d54a3a132ebb", "comment": "Malware payload (Mirai)", "value": "fba2efd8f909afa2e76f9cbaf6dfd19487682458ee90126b06e4889feeb44592", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264092, "uuid": "e62d1dfe-aa50-4d8e-8a8e-2ad5b6400918", "comment": "Malware payload (Mirai)", "value": "8da40e299659dfa715a813ba6d30fae0b39552df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785264092, "uuid": "876c3317-96c0-4d42-815c-cae4a4a11e9b", "comment": "Malware payload (Mirai)", "value": "2e924560ac4de8ed0c7efce0203ea1dfaaf4d10572498870f5e1d9d6ab798ee9953c8a0d7832c7aeb7b211bf1b79de7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264092, "uuid": "cf7a870b-7fd4-484c-9a75-dfc4c4b97a8b", "value": "T1C4E30949F8519F23C6C615BBFF4E828C772617A8D3EE72039D156F25368B85B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264092, "uuid": "438bb8ae-b4fd-41ee-9476-9d58f713d996", "value": "3072:xvui5u2Swe4VQn04BCfTjmtkz8/nuvhE:xvuWwow04BsTjmU82vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785264092, "uuid": "b7680e5c-1f5c-4b9d-ad20-94027a3305d7", "value": 147436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785264092, "uuid": "1088958d-22a7-4341-b885-307fc9bfc0d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785264092, "uuid": "b06a2ed8-345e-43c8-a454-35af86816a8b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d441240c-8a28-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785204338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785204338, "uuid": "ab090fed-8f24-4798-b767-1c4f8f113942", "comment": "Malware payload (RemcosRAT)", "value": "e9985c83a9ef65973cbaa4e2673c597a", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785204338, "uuid": "2b6a8b71-d825-44d5-b9d3-95f8ba824466", "comment": "Malware payload (RemcosRAT)", "value": "fc09faa3fdbf0f6b7d7aad125eca6798b8fb928714dfb0c6b7964a866fdffe39", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785204338, "uuid": "0f1eef27-48d7-4c9e-bf68-34d8feef48af", "comment": "Malware payload (RemcosRAT)", "value": "cdd5f5657b7efdab718d345d94693cb04a15c538", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785204338, "uuid": "0391b67b-2404-499b-bc5b-eabd0bb3a4d9", "comment": "Malware payload (RemcosRAT)", "value": "541b911574476b529308ac1d60b7f76ca6afa4ed6a86079aaf4246ce0185383d5e56b2c12020cf495ca6902082dd4a39", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785204338, "uuid": "286d84fc-9e68-4454-bdaf-4eba0a96a800", "value": "T19D442820DCD80B3A0E5707EDFF500A65C9FDC529863790ACEA9E171E50125ACDBBF268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785204338, "uuid": "aac9567a-56e0-4027-8fe7-f7d211fb4f99", "value": "6144:FupyvMhX48ZdWIQqUNpXF/hJVuiyRB5vYGTKD:iA8ZdWusph94DYxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785204338, "uuid": "6446ae67-3fa3-4e38-bc13-25ef5e0119d7", "value": 276313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785204338, "uuid": "53e1cc01-c390-4b5d-80eb-a6715bcf3277", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785204338, "uuid": "9f2e0c07-0ff6-4094-aa5d-9074436c5caa", "value": "SC_TR11670000_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ebadbd-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785211044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211044, "uuid": "6b1394b7-a657-4929-b34f-dd459decced4", "comment": "Malware payload (Mirai)", "value": "254e4836faa15d666d1fc4716267e626", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211044, "uuid": "2588d820-5234-4616-a049-3f600ef538de", "comment": "Malware payload (Mirai)", "value": "fc19c4f3bb420fbc3d14f64e45648bf0515ac81cc1b780fca424a1c835cba069", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211044, "uuid": "4c298325-a116-4c20-b520-b59919135f7b", "comment": "Malware payload (Mirai)", "value": "244c2413dfc8a2306e3db9b2a2996f2fbf9f8b95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211044, "uuid": "3b224281-daf1-4b1c-b796-63bb2b0d8b23", "comment": "Malware payload (Mirai)", "value": "ee7fed53331223442ce849aa655ad3163d02a41f71c23d8c5863360bb70b6454a95d9802a0360e3d0bee504ac0e83ef2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211044, "uuid": "6c2609ae-5e0a-432f-b297-c517b99e800a", "value": "T130B43955F8809FA1C6C12976F64D86AC33134B79D3EB720689245B343BEB86B0F3B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211044, "uuid": "c6560b2b-b1b0-4772-8f55-29c09f7ec4b8", "value": "12288:x71pyF4FMiu0Brwpsd/uCTiuPvZgpj1na5:xW4FRu09wps9P2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211044, "uuid": "ca897170-ea26-4f10-9060-2d19fbd830ff", "value": 500916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211044, "uuid": "cdc490e0-5b8d-4f16-991b-67b7201f7239", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211044, "uuid": "ca682244-8b1b-4ff7-bb45-33278339c689", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8755e4-8a89-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785245958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245958, "uuid": "e9f04289-e73c-4e56-a54c-26f17f500343", "comment": "Malware payload (Mirai)", "value": "262b0f637b98bcf02cf5409a361cf23a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245958, "uuid": "5901be98-028a-4711-a758-aff17eeb9044", "comment": "Malware payload (Mirai)", "value": "fc4e03d16f6c61e048d1257407c1b4a1cf15dcd5ecf6b0556891c0b7153bd590", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245958, "uuid": "5eeba60c-f86b-42db-967c-b3f6cf4bb531", "comment": "Malware payload (Mirai)", "value": "326b0bb0851cb53ab9b17321cb410e8f9237c8d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785245958, "uuid": "edccf749-17ef-49ab-93a4-97a8988f049d", "comment": "Malware payload (Mirai)", "value": "6605230c0f6b8c97b25196ddc77019ce91f2e77f49f2f75297abd51e4b92ca398c4d1ec7fa1e89b20daa860989e627fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245958, "uuid": "969aca6a-c333-4ea3-b061-5db972e8c7a0", "value": "T13A63F86BB9819F15C5C1167AFE1E534D331327B8E3DEB213EE142B652B8B46B0F2A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245958, "uuid": "2f862a25-0831-4c4b-bc8c-5e88d5b48a99", "value": "1536:HOn8ITgpOcXojnA7kBWvRpIcqAu3xF+182A4Yi+YWBJI4EKJxpgh:7ITsojAhIfAsxF+1xcYWBJIuJxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785245958, "uuid": "aa215e5e-d210-4ceb-884b-cf3995bed723", "value": 67372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785245958, "uuid": "44ea7ab0-210f-4db8-a4ef-b6d732d51d81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785245958, "uuid": "fea389ee-aaf3-488e-a043-71031a50c2cb", "value": "14d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4da4963-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785221036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221036, "uuid": "6005fb81-6896-49ac-ad6f-50df026a1768", "comment": "Malware payload", "value": "f766ac04e882784e4389d97ce798da6b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221036, "uuid": "e2c60c1f-2895-499e-93ea-1b289643d704", "comment": "Malware payload", "value": "fc9a417c04cdbb7c721ccc7a03fdf62e20ddcb082caf1ffc42b9d12961d6d0c3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221036, "uuid": "2764c34d-4571-474b-93fe-4ee6249e879c", "comment": "Malware payload", "value": "a24698ca74bd50a5b7311740fd755294150c5dcb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785221036, "uuid": "39c2d743-ea7b-4428-ba77-6050c6bff467", "comment": "Malware payload", "value": "7fd51efb6cf0ae497768ff762268c6cd3487bd90c64c32f32d109dd0b4e282367d301ddc4871b9706f85b04cfbeacfd1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221036, "uuid": "7f2dbb5c-ad47-4a21-a59b-08ba46f9ae4c", "value": "T1C3818C6DD00D9415EB7A23715A2317BA6F6B8218D485A3133CBB98BC250C0B3EF314B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221036, "uuid": "12e1e74b-ef12-48fd-be25-4394c77786a8", "value": "48:9+uiLFBw5rRvsahMl6YSTvGiO/HuYFV2XFJLfFni0xRQgqy3UoqaJEvcFg+taiAd:w/0dTasvGis0JLHxyOqintOzlgRAH/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785221036, "uuid": "8084e85c-af50-4710-b3ee-65e9d22804f7", "value": 3894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785221036, "uuid": "aef393d0-ff54-4c82-9175-a01d71016be7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785221036, "uuid": "7130a9ad-7176-4c90-93d5-5ef189d90fdb", "value": "images_20260727_105855.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d13491-8a96-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785251341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251341, "uuid": "8c5b1cf3-cb69-4e67-8e45-d2817ebc6829", "comment": "Malware payload (Mirai)", "value": "e3192b3391119216057fc057f9528cca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251341, "uuid": "d40ce7ef-4662-42bd-bd0f-58042bec2267", "comment": "Malware payload (Mirai)", "value": "fcab625802f842e6acaf24a0a717c0f0d40cc0c68f46f769b6be25f90c4742d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251341, "uuid": "40f3524e-62f1-4a21-9327-35cc72dc1608", "comment": "Malware payload (Mirai)", "value": "0f79f289acfdab6b8a50308c54a02e3c6f7b9703", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785251341, "uuid": "d7bca7f3-4e91-4886-8969-95822bd73771", "comment": "Malware payload (Mirai)", "value": "7a6f63713cf44b001ce3005812ecc0591c57b98a10e23eec5b2a57ef901500d329b6d74a5d04a8df9a1d4c2ce89edfe2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251341, "uuid": "230c9ec2-1e23-4bd2-a214-91c9c5615a12", "value": "T146A35C86F793E0F0D94605B0112FF77A9634EE625024DE5AEFD47E72AD32A42A21731C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251341, "uuid": "1d59563d-a8b3-4973-98b0-39c5e4a7af24", "value": "1536:2IBSrZpnS5Bt3HNwZU0N3ndzbkNIYBYH7U+31E5HNLWoQivtB1YSXNs5HMPxr:WrZViT3HNwB3dzbkNUenn/tOHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785251341, "uuid": "332327bb-1eed-4988-892a-36c2340411de", "value": 99472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785251341, "uuid": "dd2cea3d-af7b-4220-a4c7-8a2b95d07c94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785251341, "uuid": "0488495b-dc01-4835-8b07-b70688651ec6", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f63cf2b-8a38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785211041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211041, "uuid": "cfd9f526-e788-4c73-bc9c-9d5504432b0a", "comment": "Malware payload (Mirai)", "value": "4f277bb281e11e83a1b1d03295415e52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211041, "uuid": "a5e7620f-9614-4778-8cc8-2a841a48996f", "comment": "Malware payload (Mirai)", "value": "fd64e2b82b41fe3f996288610e24d93e1f0434507058727b0282b43378a6a948", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211041, "uuid": "9bbe9072-547c-4b5b-a99c-2e3b939ed8b1", "comment": "Malware payload (Mirai)", "value": "9be2ad6c431dc7a39b00323f115517b3fa47e421", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785211041, "uuid": "9703b884-6a10-49b8-81bb-dab07c8344f2", "comment": "Malware payload (Mirai)", "value": "e373419f4af4a18f4b419d78ae4c1640f5241b6fce52e0c5fc4e9cf64a650b064ad29e5f4f3e9e097f7e1444cead7373", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211041, "uuid": "7f14c9eb-357c-4483-bdea-ae701e94b3f3", "value": "T1352422116F42688FE89D967A911526F59D09F3C136FFCB1193080224FF3D862BAA78F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211041, "uuid": "262b9951-abef-49c2-a0cb-977e38a6d6cc", "value": "3072:vrpF+CDg8GE0t7Z0kOryjctGPsJTGk0UKjaoOaV2oRwDFvZDuyaKZoX9u:vrppDgZaGjckOak0nIaVhRoFZa/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785211041, "uuid": "473eb826-52e5-482d-b806-f70d8426f57d", "value": 218024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785211041, "uuid": "5f08e980-dbfc-4fd5-bdfc-48247538153b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785211041, "uuid": "71731aa4-04b9-4aca-8ccf-8aeb0e16fdb5", "value": "dlr.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3c7d2c-8a98-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785252375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252375, "uuid": "74721064-37ef-4067-9008-828bf2ea5a36", "comment": "Malware payload", "value": "1803e4f6b6f32579bd7e67f936afa284", "object_relation": "md5", "Tag": [ { "name": "EncodedInjected", "colour": "#1E1E71", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252375, "uuid": "c278a161-bd77-4d56-a53d-1545fd2e7018", "comment": "Malware payload", "value": "febddaec6b71897a06c854afecb1ea9c9167934c873b1fba9ad50ff4b3f8322c", "object_relation": "sha256", "Tag": [ { "name": "EncodedInjected", "colour": "#1E1E71", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252375, "uuid": "399e33ca-7fb8-4e09-bf66-da0a0cd72f95", "comment": "Malware payload", "value": "e4a303f9b22391c253358c5ddfa7f7025ed3b805", "object_relation": "sha1", "Tag": [ { "name": "EncodedInjected", "colour": "#1E1E71", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785252375, "uuid": "0c5dedeb-2585-4962-bf6d-6312a75c330e", "comment": "Malware payload", "value": "d39eb4b76a6b7930955b8a50f3af09d73c7d6a6baf9a7fb880b66d19e662563123a0b7c7ecce368b711c5b579b26e80c", "object_relation": "sha3-384", "Tag": [ { "name": "EncodedInjected", "colour": "#1E1E71", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252375, "uuid": "0f7b3e1c-5869-4d85-bcf8-b99541be3c07", "value": "T138C19F867E01E18441F903BD5566715154C2A0EB8DDD33DFAF32B259ECA73EA1848A7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252375, "uuid": "2048d9b1-9d7c-4834-8a77-86e984d2e1c0", "value": "96:s8qb4onQ2p3W0lyEmv6NvhAsvlJbU2C3M4mXxoLFSLvubWMpAxJ4xQoumrVc+FX:Tq8on53jmv6NZJV7RKLOvubq4xHuOtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785252375, "uuid": "70d7d95a-073e-4398-b34f-ad2736b5e2b4", "value": 5649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785252375, "uuid": "e6aec6de-cb5d-408b-b4b5-d2eae140e4e8", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785252375, "uuid": "484cd51f-c3b7-4060-aa68-7ff2e4cd8731", "value": "cache.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55214fe4-8a4f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785220876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220876, "uuid": "82b0183f-6f74-4a36-bbf2-4af3f7605602", "comment": "Malware payload", "value": "6ceac46faa68436c13e666aec0ae4baf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220876, "uuid": "620e3e92-91f8-48c8-a51a-f7a5c8e304cc", "comment": "Malware payload", "value": "ff227f252b32e43e918752e4ec9a4b555e9db7c72ec7a06c7c87c3892778be6e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220876, "uuid": "cdeb362a-1bd8-42df-8fe7-a99286c27258", "comment": "Malware payload", "value": "2950df98ecdb11cff4624e3e5561fbe44b9a2508", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785220876, "uuid": "e8789385-4a48-483e-8d0d-88818b7362de", "comment": "Malware payload", "value": "eff0cc72459568c8de769cd25196eb775abf8ecc81345ef6a2684ff963633583bbae08dc284e07b7c04184ddc4145496", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220876, "uuid": "c0eeb262-7274-4411-85bc-1203d61a89fd", "value": "T18052C030CD10A1109F749E77F9D3DB53A08489E6F06FA3A87E2F600F406DA42496E7A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220876, "uuid": "815d314d-1911-4060-91d1-5d933f5c5abc", "value": "384:7Nc6Yvitbr7yOmSKB0j4v89zxoFsQOonNGWyMx3aW:kvitX7y50UUdxoCUnR39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785220876, "uuid": "7cb08b1e-36f4-4eb6-b945-67d2d80d2837", "value": 14485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785220876, "uuid": "e71afe6b-3681-4777-b57b-5609f0f4dced", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785220876, "uuid": "1dde26e3-2e11-4410-920f-030b75b485e0", "value": "images_20260727_084709.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe586eda-8a84-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785243923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785243923, "uuid": "b5b954c2-4370-4423-895a-cb21ad665c0b", "comment": "Malware payload", "value": "bec9f9f82c5da2edfdf23212920f85a8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785243923, "uuid": "cc2a44ac-06b2-4394-a2f8-179d9cab84a9", "comment": "Malware payload", "value": "ff9abbcfac25566a54fad27a2f48514f12412d8ecd5a34d7d5a5e0f04773d044", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785243923, "uuid": "123cd353-0fd6-446a-ba02-3074633dba92", "comment": "Malware payload", "value": "e85a68cbe8d23eb88feff842747af7070b66903e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785243923, "uuid": "030240c8-28bb-41e8-8f62-342ab9104a76", "comment": "Malware payload", "value": "7ff324e018b3937314dc63bab50bd2a7befa0732b14429bc3ba203e20a2d1770bd6deb1848d058d04eb131df9e2d21a8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785243923, "uuid": "7e44fdd4-b25c-4e52-be75-4aa934d6b096", "value": "T1FD236C6516857C25AA99C4371C7E2F0CBDAD43E6320452DE7FCE3CF28C4AA9DA20971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785243923, "uuid": "72276ceb-1afc-496e-91d7-b7d385f19b57", "value": "768:Kcsr0a1ldg9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:0hdcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785243923, "uuid": "f6363025-9e7e-4411-8ba0-44ee8bc1861d", "value": 50067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785243923, "uuid": "6a6b933b-a258-40d9-a529-c7027fd89ea2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785243923, "uuid": "5c15d5ab-1d27-4e4d-94e3-d40df3ccc931", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }